The Linux kernel DRM subsystem had a race condition in the change_handle ioctl operation where a single object could temporarily have two idr entries. Concurrent gem_close operations could delete one handle while leaving the other dangling, leading to a use-after-free vulnerability. The fix involved setting the old handle to NULL before swapping handles to avoid dangling references, similar to the approach used in gem_close. Additional related fixes were applied to handle similar race conditions in drm_gem_handle_create_tail. This vulnerability is tracked as CVE-2026-46215 and affects linux-hwe-edge kernel versions prior to several 7.0.0-xx releases.

Successful exploitation could lead to use-after-free conditions in the DRM subsystem, potentially allowing local attackers with limited privileges to cause memory corruption. The CVSS score of 7.8 indicates high impact on confidentiality, integrity, and availability. However, exploitation requires local access and low complexity, with no user interaction needed. There are no known exploits in the wild at this time.

An official patch is available and should be applied by updating the Linux kernel to versions 7.0.0-28.28 or later (and other specified 7.0.0-xx versions). After updating, a system reboot is required. Due to an ABI change, third-party kernel modules must be recompiled and reinstalled. Follow the vendor advisory instructions for updating and recompiling kernel modules to fully mitigate this vulnerability.