Executive brief
A vulnerability was identified in the Linux kernel's Graphics Execution Manager (GEM), which manages memory for graphics drivers. A flaw in how the system handles requests to change memory object identifiers could allow a local user to cause a system crash or instability. To ensure system safety, developers have temporarily disabled the affected feature until more robust security testing is completed.
Technical details
A race condition exists in the 'drm_gem_change_handle_ioctl' function within the DRM GEM (Graphics Execution Manager) subsystem of the Linux kernel. The vulnerability stems from improper synchronization and reference counting when swapping GEM handles, specifically between 'gem_close' and 'gem_change_handle' operations. An attacker with local access could exploit this race to trigger use-after-free conditions or IDR corruption. Due to the complexity of the fix and multiple failed previous attempts, the ioctl has been disabled in the latest patches until comprehensive testing and a verified fix are implemented.
Affected products
- Linux Linux Kernel All versions prior to the fix in June 2026
Timeline
- 2026-06-04: disclosed: Initial patch submission by Simona Vetter
- 2026-06-25: advisory: CVE-2026-53145 published
- 2026-06-25: patched: Fixes merged into stable kernel branches