PT-2026-61202 · Linux · Linux

CVE-2026-63885 · Published 2026-07-19 · Updated 2026-07-19

Mitre

CVSS v3.1

8.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

In the Linux kernel, the following vulnerability has been resolved:

drm/gem: fix race between change handle and handle delete

drm gem change handle ioctl leaves the old handle live in the IDR during the window between spin unlock(table lock) and the final spin lock(table lock). A concurrent drm gem handle delete on the old handle succeeds in this window, decrements handle count to 0, and frees the GEM object while the new handle's IDR entry still references it.

NULL the old handle's IDR entry before dropping table lock so that any concurrent GEM CLOSE on the old handle sees NULL and returns -EINVAL. Restore the old entry on the prime-bookkeeping error path.

Fix

Related Identifiers

CVE-2026-63885

Affected Products

Linux

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-63885 · Security Note
• https://git.kernel.org/stable/c/0dfa42cfe4dbe114533480503934f43e33c1e83d · Note
• https://git.kernel.org/stable/c/cde2c9257cbe8463b9dcf7b1075177b72b5fd938 · Note
• https://git.kernel.org/stable/c/7164d78559b0ff29931a366a840a9e5dd53d4b7c · Note