Executive brief
A logic error was identified in the Linux kernel's Direct Rendering Manager (DRM) subsystem, which handles communication between the operating system and graphics hardware. This flaw could lead to system instability or crashes when managing graphics memory handles. While primarily affecting system reliability, such kernel-level issues can sometimes be leveraged to disrupt operations or gain unauthorized access.
Technical details
A logical error exists in the 'change handle' logic within the DRM subsystem of the Linux kernel. Specifically, in `drivers/gpu/drm/drm_gem.c`, the code failed to correctly replace a newly generated IDR pointer with the old ID's pointer during the execution flow of `drm_gem_change_handle_ioctl`. This resulted in a failure to properly track dma-buf objects, leading to warnings in `drm_prime_destroy_file_private` and potential use-after-free or memory leak scenarios. The vulnerability is reachable via local IOCTL calls. Patches have been released for various stable branches including 6.18.x and 7.0.x.
Affected products
- Linux Linux 6.18.32, 7.0.9
Timeline
- 2026-05-13: other: Vulnerability fixed in source code
- 2026-06-24: disclosed: CVE published