PT-2026-8144 · Linux · Linux Kernel

Published 2026-01-01 · Updated 2026-06-11 · CVE-2026-23149

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A flaw exists in the Linux kernel where userspace can trigger kernel warnings within the drm gem change handle ioctl() function. This occurs because GEM buffer object handles are represented as 32-bit integers in the user API, while the internal implementation uses integer ranges. Providing a handle value exceeding the maximum integer value triggers a kernel warning due to the WARN ON ONCE() macro. The issue is addressed by rejecting new handles above the maximum integer value and clarifying the end limit calculation.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2026-23149

Affected Products

Linux Kernel

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23149.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-23149 · Security Note
• https://git.kernel.org/stable/c/ae8831ee0fb2f5f41f39722e7b3749d65bb78d08 · Patch
• https://osv.dev/vulnerability/CVE-2026-23149 · Vendor Advisory
• https://git.kernel.org/stable/c/12f15d52d38ac53f7c70ea3d4b3d76afed04e064 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-23149 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-23149 · Security Note
• https://ubuntu.com/security/CVE-2026-23149 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-23149 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-23149 · Vendor Advisory
• https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git · Note
• https://t.me/opennews/15597 · Telegram Post
• https://twitter.com/CVEnew/status/2022708985627910634 · Twitter Post
• https://git.kernel.org/linus/12f15d52d38ac53f7c70ea3d4b3d76afed04e064 · Note