CVE-2026-63885
Gravedad CVSS v3.1:
ALTA
Tipo:
No Disponible / Otro tipo
Fecha de publicación:
19/07/2026
Última modificación:
20/07/2026
Descripción
*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br />
<br />
drm/gem: fix race between change_handle and handle_delete<br />
<br />
drm_gem_change_handle_ioctl leaves the old handle live in the IDR<br />
during the window between spin_unlock(table_lock) and the final<br />
spin_lock(table_lock). A concurrent drm_gem_handle_delete on the old<br />
handle succeeds in this window, decrements handle_count to 0, and frees<br />
the GEM object while the new handle&#39;s IDR entry still references it.<br />
<br />
NULL the old handle&#39;s IDR entry before dropping table_lock so that any<br />
concurrent GEM_CLOSE on the old handle sees NULL and returns -EINVAL.<br />
Restore the old entry on the prime-bookkeeping error path.
Impacto
Puntuación base 3.x
8.80
Gravedad 3.x
ALTA