CVE-2026-46215

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> drm: Set old handle to NULL before prime swap in change_handle<br /> <br /> There was a potential race condition in change_handle. The ioctl<br /> briefly had a single object with two idr entries; a concurrent<br /> gem_close could delete the object and remove one of the handles<br /> while leaving the other one dangling, which could subsequently<br /> be dereferenced for a use-after-free.<br /> <br /> To fix this, do the same dance that gem_close itself does.<br /> (f6cd7daecff5 drm: Release driver references to handle before making it available again)<br /> First idr_replace the old handle to NULL. Later, if the prime<br /> operations are successful, actually close it.<br /> <br /> create_tail required a similar dance to avoid a similar problem.<br /> (bd46cece51a3 drm/gem: Fix race in drm_gem_handle_create_tail())<br /> It idr_allocs the new handle with NULL, then swaps in the correct<br /> object later to avoid races. We don&amp;#39;t need to do that here, since<br /> the only operations that could race are drm_prime, and<br /> change_handle holds the prime lock for the entire duration.<br /> <br /> v2: cleanups of error paths