In the Linux kernel, the following vulnerability has been resolved: drm: Set old handle to NULL before prime swap in change_handle There was a… (CVE-2026-46215)
In the Linux kernel, the following vulnerability has been resolved: drm: Set old handle to NULL before prime swap in change_handle There was a potential race condition in change_handle. The ioctl briefly had a single object with two idr entries; a concurrent gem_close could delete the object and remove one of the handles while leaving the other one dangling, which could subsequently be dereferenced for a use-after-free. To fix this, do the same dance that gem_close itself does. (f6cd7daecff5 drm: Release driver references to handle before making it available again) First idr_replace the old handle to NULL. Later, if the prime operations are successful, actually close it. create_tail required a similar dance to avoid a similar problem. (bd46cece51a3 drm/gem: Fix race in drm_gem_handle_create_tail()) It idr_allocs the new handle with NULL, then swaps in the correct object later to avoid races. We don't need to do that here, since the only operations that could race are drm_prime, and change_handle holds the prime lock for the entire duration. v2: cleanups of error paths
AI Analysis
Technical Summary
The vulnerability in the Linux kernel DRM subsystem was a race condition in the change_handle ioctl operation. During a prime buffer handle swap, the kernel briefly had a single object referenced by two IDR entries. A concurrent gem_close could delete the object and remove one handle while leaving the other dangling, leading to a use-after-free scenario. The fix involved setting the old handle to NULL before the swap to prevent concurrent access to a freed object. Similar race conditions were addressed in related functions by ensuring proper handle allocation and replacement under locking. This resolves the CWE-416 (Use After Free) vulnerability.
Potential Impact
Successful exploitation could lead to use-after-free conditions in the kernel, potentially allowing an attacker with local privileges to cause memory corruption. This could result in privilege escalation, denial of service, or arbitrary code execution within the kernel context. The CVSS vector indicates high impact on confidentiality, integrity, and availability.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is applied, avoid untrusted local access to the DRM subsystem. Monitor vendor channels for updates and apply patches promptly once available.
In the Linux kernel, the following vulnerability has been resolved: drm: Set old handle to NULL before prime swap in change_handle There was a… (CVE-2026-46215)
Description
In the Linux kernel, the following vulnerability has been resolved: drm: Set old handle to NULL before prime swap in change_handle There was a potential race condition in change_handle. The ioctl briefly had a single object with two idr entries; a concurrent gem_close could delete the object and remove one of the handles while leaving the other one dangling, which could subsequently be dereferenced for a use-after-free. To fix this, do the same dance that gem_close itself does. (f6cd7daecff5 drm: Release driver references to handle before making it available again) First idr_replace the old handle to NULL. Later, if the prime operations are successful, actually close it. create_tail required a similar dance to avoid a similar problem. (bd46cece51a3 drm/gem: Fix race in drm_gem_handle_create_tail()) It idr_allocs the new handle with NULL, then swaps in the correct object later to avoid races. We don't need to do that here, since the only operations that could race are drm_prime, and change_handle holds the prime lock for the entire duration. v2: cleanups of error paths
CVSS v3.1
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in the Linux kernel DRM subsystem was a race condition in the change_handle ioctl operation. During a prime buffer handle swap, the kernel briefly had a single object referenced by two IDR entries. A concurrent gem_close could delete the object and remove one handle while leaving the other dangling, leading to a use-after-free scenario. The fix involved setting the old handle to NULL before the swap to prevent concurrent access to a freed object. Similar race conditions were addressed in related functions by ensuring proper handle allocation and replacement under locking. This resolves the CWE-416 (Use After Free) vulnerability.
Potential Impact
Successful exploitation could lead to use-after-free conditions in the kernel, potentially allowing an attacker with local privileges to cause memory corruption. This could result in privilege escalation, denial of service, or arbitrary code execution within the kernel context. The CVSS vector indicates high impact on confidentiality, integrity, and availability.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is applied, avoid untrusted local access to the DRM subsystem. Monitor vendor channels for updates and apply patches promptly once available.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-gm2j-59pp-6cxj
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-46215"]
- Ecosystems
- []
- Database Specific Severity
- HIGH
- Cvss Version
- 3.1
Threat ID: 6a50ba6b68715ace4357f891
Added to database: 07/10/2026, 09:24:59 UTC
Last enriched: 07/10/2026, 09:49:05 UTC
Last updated: 07/26/2026, 08:52:02 UTC
Views: 10
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.