PT-2026-61202 · Linux · Linux

CVE-2026-63885 · Publicado 2026-07-19 · Atualizado 2026-07-19

Mitre

CVSS v3.1

8.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

In the Linux kernel, the following vulnerability has been resolved:

drm/gem: fix race between change handle and handle delete

drm gem change handle ioctl leaves the old handle live in the IDR during the window between spin unlock(table lock) and the final spin lock(table lock). A concurrent drm gem handle delete on the old handle succeeds in this window, decrements handle count to 0, and frees the GEM object while the new handle's IDR entry still references it.

NULL the old handle's IDR entry before dropping table lock so that any concurrent GEM CLOSE on the old handle sees NULL and returns -EINVAL. Restore the old entry on the prime-bookkeeping error path.

Correção

Identificadores relacionados

CVE-2026-63885

Produtos afetados

Linux

Referências · 4

• https://git.kernel.org/stable/c/0dfa42cfe4dbe114533480503934f43e33c1e83d · Nota
• https://git.kernel.org/stable/c/cde2c9257cbe8463b9dcf7b1075177b72b5fd938 · Nota
• https://git.kernel.org/stable/c/7164d78559b0ff29931a366a840a9e5dd53d4b7c · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-63885 · Nota de Segurança