In the Linux kernel, the following vulnerability has been resolved:
drm/gem: fix race between change_handle and handle_delete
drm_gem_change_handle_ioctl leaves the old handle live in the IDR
during the window between spin_unlock(table_lock) and the final
spin_lock(table_lock). A concurrent drm_gem_handle_delete on the old
handle succeeds in this window, decrements handle_count to 0, and frees
the GEM object while the new handle's IDR entry still references it.
NULL the old handle's IDR entry before dropping table_lock so that any
concurrent GEM_CLOSE on the old handle sees NULL and returns -EINVAL.
Restore the old entry on the prime-bookkeeping error path.
References
Configurations
Configuration 1 (hide)
|
History
26 Oct 2026, 20:16
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Linux linux Kernel
Linux |
|
| CPE | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.1:rc5:*:*:*:*:*:* |
|
| References | () https://git.kernel.org/stable/c/0dfa42cfe4dbe114533480503934f43e33c1e83d - Patch | |
| References | () https://git.kernel.org/stable/c/7164d78559b0ff29931a366a840a9e5dd53d4b7c - Patch | |
| References | () https://git.kernel.org/stable/c/cde2c9257cbe8463b9dcf7b1075177b72b5fd938 - Patch |
19 Oct 2026, 21:17
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-362 |
Information
Published : 2026-07-19 16:17
Updated : 2026-10-26 20:16
NVD link : CVE-2026-63885
Mitre link : CVE-2026-63885
CVE.ORG link : CVE-2026-63885
JSON object : View
Products Affected
linux
- linux_kernel
CWE
CWE-362
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')