Executive brief
A race condition exists in the Linux kernel's Direct Rendering Manager (DRM) subsystem, which handles GPU device communication on Linux systems. If device registration fails after a minor device is already registered, userspace applications that have opened the device can continue executing operations while the kernel tears down resources, potentially causing memory corruption, crashes, or data loss. This affects systems with graphics cards or accelerators using the DRM subsystem.
Technical details
The vulnerability is a race condition (CWE-362) in the DRM device registration path (drm_dev_register()). When drm_dev_register() fails after registering a minor device (e.g., render minor succeeds but primary minor fails), userspace processes that have already opened the first minor and entered a drm_dev_enter() critical section will continue executing ioctl operations. The unplugged flag is not set during the partial failure, so the kernel proceeds with resource cleanup (drm_dev_unregister()) while in-flight ioctl handlers are still running, creating a use-after-free scenario. The fix introduces drm_dev_synchronize_unplug(), which sets the unplugged flag and calls synchronize_srcu() to ensure all in-flight drm_dev_enter() critical sections complete before cleanup proceeds. Attack vector is local, requiring ability to open a DRM device. Patches are available in kernel stable branches.
Affected products
- Linux Linux Kernel Multiple stable branches from 2.6.11 through 7.2
Timeline
- 2026-09-16: disclosed: Published on NVD
- 2026-09-14: patched: Stable kernel patches available from Greg Kroah-Hartman
- 2026-06-28: other: Upstream commit by Danilo Krummrich