Analysis of vulnerability CVE-2026-46215: local privilege escalation via UAF in Linux DRM GEM

In the article, the researcher demonstrates how a use-after-free bug in the DRM_IOCTL_GEM_CHANGE_HANDLE handler in the Linux kernel lets a regular user gain root privileges (CVE-2026-46215). When a GEM object is transferred between handles, the handle_count counter isn't updated, and if DRM_IOCTL_GEM_CLOSE is invoked simultaneously, the old handle frees the object, leaving the new one pointing to freed memory.

The exploit leverages a race condition to overwrite the freed portion of the drm_gem_object structure with pipe_buffer elements (via a pipe/msg_msg spray), leaks a kernel pointer to bypass KASLR, and sets PIPE_BUF_FLAG_CAN_MERGE to once again bypass the DirtyPipe fix. As a result, an attacker with access to /dev/dri/renderD can modify /etc/passwd from a user process and gain root access.

Article: https://cyberstan.co.uk/drm-lpe-linux/

PoC: https://github.com/0xCyberstan/CVE-2026-46215-POC