kernel: drm: Set old handle to NULL before prime swap in change_handle

A flaw was found in the Linux kernel. A race condition in the Direct Rendering Manager DRM subsystem's changehandle function could allow a local attacker to trigger a use-after-free vulnerability. This occurs when a concurrent gemclose operation removes one handle while another remains dangling...

CVE-2026-63885

The CVE concerns a race in the Linux kernel DRM GEM path: drm_gem_change_handle_ioctl can leave the old handle live in the IDR during the window after spin_unlock(table_lock) and before the final spin_lock(table_lock). A concurrent drm_gem_handle_delete on the old handle may decrement handle_coun...

EUVD-2026-39236

In the Linux kernel, the following vulnerability has been resolved: drm/gem: Try to fix changehandle ioctl, attempt 4 airlied: just added some comments on how to reenable On-list because the cat is out of the bag and we're clearly not good enough to figure this out in private. The story thus far:...

CVE-2026-46215

In the Linux kernel, the following vulnerability has been resolved: drm: Set old handle to NULL before prime swap in changehandle There was a potential race condition in changehandle. The ioctl briefly had a single object with two idr entries; a concurrent gemclose could delete the object and...

CVE-2026-46215 drm: Set old handle to NULL before prime swap in change_handle

In the Linux kernel, the following vulnerability has been resolved: drm: Set old handle to NULL before prime swap in changehandle There was a potential race condition in changehandle. The ioctl briefly had a single object with two idr entries; a concurrent gemclose could delete the object and...

CVE-2026-46215

The CVE concerns a race condition in the Linux kernel’s DRM change_handle path. A concurrent gem_close could remove one handle while another remained dangling, enabling a use-after-free. The fix uses the same sequence as gem_close: first replace the old handle with NULL via idr_replace, then, if ...

Astra Linux – Vulnerability in Linux, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: drm/virtio: Fixed the UAF issue related to GEM handle creation. The user space can guess the handle value and attempt to race the GEM object creation with the handle being closed. This can lead to a use-after-free scenario if we...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-986673)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-986673 advisory. In the Linux kernel, the following vulnerability has been resolved: drm/virtio: Fix GEM handle creation UAF Userspace can guess the handle value and try to race GEM...

CVE-2025-39941

CVE-2025-39941 relates to the Linux kernel zram subsystem. The vulnerability arises from a race in slot write handling where parallel writes to the same zram index can leak zsmalloc handles because zs_free() is executed too early. The documented fix is to reset the zram entry and assign the new h...

Linux Distros Unpatched Vulnerability : CVE-2025-38028

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: NFS/localio: Fix a race in nfslocalopenfh Once the clp-cluuid.lock has been dropped, another...

SUSE CVE-2022-48899

In the Linux kernel, the following vulnerability has been resolved: drm/virtio: Fix GEM handle creation UAF Userspace can guess the handle value and try to race GEM object creation with handle close, resulting in a use-after-free if we dereference the object after dropping the handle's reference...