CVE-2026-63885 addresses a race condition in the Linux kernel's drm/gem subsystem. Specifically, drm_gem_change_handle_ioctl left the old handle live in the IDR between unlocking and re-locking the table_lock spinlock. During this window, a concurrent drm_gem_handle_delete on the old handle could succeed, decrementing the handle count to zero and freeing the GEM object while the new handle's IDR entry still referenced it. The vulnerability was fixed by nulling the old handle's IDR entry before dropping the lock, ensuring concurrent GEM_CLOSE operations see NULL and return an error instead of accessing freed memory. The fix also restores the old entry on error paths related to prime bookkeeping.

Successful exploitation could lead to use-after-free conditions in the DRM GEM subsystem, potentially causing system instability, crashes, or privilege escalation due to corrupted kernel memory. The CVSS 3.1 score is 8.8, indicating high impact on confidentiality, integrity, and availability. However, the attack vector is local with low privileges required and no user interaction needed.

A fix for this vulnerability has been implemented in the Linux kernel. Users should apply the official kernel updates from their Linux distribution vendors to remediate this issue. Since this is not a cloud service, remediation depends on patching the affected kernel versions. Patch status is not explicitly confirmed in the provided data; therefore, check the vendor advisory or distribution security notices for the exact patched versions and update accordingly.