CVE-2026-63885
Severity CVSS v4.0:
Pending analysis
Type:
Unavailable / Other
Publication date:
19/07/2026
Last modified:
20/07/2026
Description
In the Linux kernel, the following vulnerability has been resolved:<br />
<br />
drm/gem: fix race between change_handle and handle_delete<br />
<br />
drm_gem_change_handle_ioctl leaves the old handle live in the IDR<br />
during the window between spin_unlock(table_lock) and the final<br />
spin_lock(table_lock). A concurrent drm_gem_handle_delete on the old<br />
handle succeeds in this window, decrements handle_count to 0, and frees<br />
the GEM object while the new handle&#39;s IDR entry still references it.<br />
<br />
NULL the old handle&#39;s IDR entry before dropping table_lock so that any<br />
concurrent GEM_CLOSE on the old handle sees NULL and returns -EINVAL.<br />
Restore the old entry on the prime-bookkeeping error path.
Impact
Base Score 3.x
8.80
Severity 3.x
HIGH