Executive brief
A race condition vulnerability was identified in the Linux kernel's Direct Rendering Manager (DRM) subsystem, which manages communication between the operating system and graphics hardware. An attacker could exploit this flaw to cause a system crash or potentially execute unauthorized code by triggering a specific timing conflict during memory handle operations. This impact primarily affects system stability and the security of the graphics memory management.
Technical details
A race condition exists in `drivers/gpu/drm/drm_gem.c` within the `drm_gem_change_handle_ioctl` function. The vulnerability occurs because the old handle remains live in the IDR (integer ID management) during a window where the `table_lock` is dropped. If a concurrent `drm_gem_handle_delete` is called during this window, it can decrement the `handle_count` to zero and free the GEM object while a new handle still references it, leading to a use-after-free. The fix involves setting the old handle's IDR entry to NULL before dropping the lock to ensure concurrent delete operations fail safely. Patches have been released for multiple stable kernel branches including 6.18.x and 7.0.x.
Affected products
- Linux Linux Kernel 6.18.32 to 6.18.35, 7.0.9 to 7.0.12
Timeline
- 2026-05-26: other: Vulnerability fix authored
- 2026-07-19: disclosed: CVE published