CVE-2026-63885 (GCVE-0-2026-63885)

Vulnerability from cvelistv5 – Published: 2026-07-19 14:54 – Updated: 2026-08-05 12:36
VLAI
Title
drm/gem: fix race between change_handle and handle_delete
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/gem: fix race between change_handle and handle_delete drm_gem_change_handle_ioctl leaves the old handle live in the IDR during the window between spin_unlock(table_lock) and the final spin_lock(table_lock). A concurrent drm_gem_handle_delete on the old handle succeeds in this window, decrements handle_count to 0, and frees the GEM object while the new handle's IDR entry still references it. NULL the old handle's IDR entry before dropping table_lock so that any concurrent GEM_CLOSE on the old handle sees NULL and returns -EINVAL. Restore the old entry on the prime-bookkeeping error path.
Severity
8.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 672464dd53231509c9c771110798c56d4660e19e , < 0dfa42cfe4dbe114533480503934f43e33c1e83d (git)
Affected: 61bd96d3e5472c253f9c1ab77608f0c8aaa9d025 , < cde2c9257cbe8463b9dcf7b1075177b72b5fd938 (git)
Affected: 5e28b7b94408897e41c63477aabc9e1db439bc8c , < 7164d78559b0ff29931a366a840a9e5dd53d4b7c (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.18.32 , < 6.18.35 (semver)
Affected: 7.0.9 , < 7.0.12 (semver)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/drm_gem.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "0dfa42cfe4dbe114533480503934f43e33c1e83d",
              "status": "affected",
              "version": "672464dd53231509c9c771110798c56d4660e19e",
              "versionType": "git"
            },
            {
              "lessThan": "cde2c9257cbe8463b9dcf7b1075177b72b5fd938",
              "status": "affected",
              "version": "61bd96d3e5472c253f9c1ab77608f0c8aaa9d025",
              "versionType": "git"
            },
            {
              "lessThan": "7164d78559b0ff29931a366a840a9e5dd53d4b7c",
              "status": "affected",
              "version": "5e28b7b94408897e41c63477aabc9e1db439bc8c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/drm_gem.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6.18.35",
              "status": "affected",
              "version": "6.18.32",
              "versionType": "semver"
            },
            {
              "lessThan": "7.0.12",
              "status": "affected",
              "version": "7.0.9",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.35",
                  "versionStartIncluding": "6.18.32",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.12",
                  "versionStartIncluding": "7.0.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/gem: fix race between change_handle and handle_delete\n\ndrm_gem_change_handle_ioctl leaves the old handle live in the IDR\nduring the window between spin_unlock(table_lock) and the final\nspin_lock(table_lock). A concurrent drm_gem_handle_delete on the old\nhandle succeeds in this window, decrements handle_count to 0, and frees\nthe GEM object while the new handle\u0027s IDR entry still references it.\n\nNULL the old handle\u0027s IDR entry before dropping table_lock so that any\nconcurrent GEM_CLOSE on the old handle sees NULL and returns -EINVAL.\nRestore the old entry on the prime-bookkeeping error path."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires local ioctl calls on /dev/dri/renderD* or /dev/dri/card* through DRM_IOCTL_GEM_CHANGE_HANDLE and DRM_IOCTL_GEM_CLOSE; there is no network-facing path to this code.\nAC:L - The attacker controls both racing threads from the same process (one issuing GEM_CHANGE_HANDLE, one issuing GEM_CLOSE on the old handle) and can repeat until the window is hit; this is a self-induced race, not one dependent on external timing.\nPR:L - Only DRM_RENDER_ALLOW is required, available to unprivileged local users with access to a render node (common on desktops, Android, browsers\u0027 GPU processes, and cloud GPU instances); no CAP_SYS_ADMIN or init-namespace root is needed.\nUI:N - No victim interaction is required beyond the attacker already having render-node access; the race is triggered entirely by the attacker\u0027s own concurrent ioctl calls.\nS:C - Successful exploitation crosses from a sandboxed application security boundary (browser GPU process, Android app sandbox, or container with passed-through GPU device) into kernel memory, enabling privilege escalation beyond the attacker\u0027s original security scope.\nC:H - The bug is a GEM object use-after-free; freed kernel heap objects can be reallocated and dereferenced via subsequent GEM operations, enabling arbitrary kernel memory disclosure.\nI:H - Use-after-free of a drm_gem_object allows heap grooming and corruption of reallocated objects, providing a standard path to arbitrary kernel write and local privilege escalation/code execution.\nA:H - The race can free a GEM object still referenced by ioctl state, causing kernel oops/panic on dereference of freed memory; UAF bugs also carry inherent crash risk even before full exploitation."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:36:54.290Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/0dfa42cfe4dbe114533480503934f43e33c1e83d"
        },
        {
          "url": "https://git.kernel.org/stable/c/cde2c9257cbe8463b9dcf7b1075177b72b5fd938"
        },
        {
          "url": "https://git.kernel.org/stable/c/7164d78559b0ff29931a366a840a9e5dd53d4b7c"
        }
      ],
      "title": "drm/gem: fix race between change_handle and handle_delete",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-63885",
    "datePublished": "2026-07-19T14:54:58.590Z",
    "dateReserved": "2026-07-19T07:54:57.018Z",
    "dateUpdated": "2026-08-05T12:36:54.290Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-63885",
      "date": "2026-09-21",
      "epss": "0.00173",
      "percentile": "0.07052"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/gpu/drm/drm_gem.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "0dfa42cfe4dbe114533480503934f43e33c1e83d",
                    "status": "affected",
                    "version": "672464dd53231509c9c771110798c56d4660e19e",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "cde2c9257cbe8463b9dcf7b1075177b72b5fd938",
                    "status": "affected",
                    "version": "61bd96d3e5472c253f9c1ab77608f0c8aaa9d025",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "7164d78559b0ff29931a366a840a9e5dd53d4b7c",
                    "status": "affected",
                    "version": "5e28b7b94408897e41c63477aabc9e1db439bc8c",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/gpu/drm/drm_gem.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "6.18.35",
                    "status": "affected",
                    "version": "6.18.32",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "7.0.12",
                    "status": "affected",
                    "version": "7.0.9",
                    "versionType": "semver"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/gem: fix race between change_handle and handle_delete\n\ndrm_gem_change_handle_ioctl leaves the old handle live in the IDR\nduring the window between spin_unlock(table_lock) and the final\nspin_lock(table_lock). A concurrent drm_gem_handle_delete on the old\nhandle succeeds in this window, decrements handle_count to 0, and frees\nthe GEM object while the new handle\u0027s IDR entry still references it.\n\nNULL the old handle\u0027s IDR entry before dropping table_lock so that any\nconcurrent GEM_CLOSE on the old handle sees NULL and returns -EINVAL.\nRestore the old entry on the prime-bookkeeping error path."
          }
        ],
        "id": "CVE-2026-63885",
        "lastModified": "2026-07-27T17:44:23.777",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 8.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "CHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.0,
              "impactScore": 6.0,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-07-19T16:17:05.623",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/0dfa42cfe4dbe114533480503934f43e33c1e83d"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/7164d78559b0ff29931a366a840a9e5dd53d4b7c"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/cde2c9257cbe8463b9dcf7b1075177b72b5fd938"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Awaiting Analysis"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-05T14:20:51+00:00",
      "cve": "CVE-2026-63885",
      "id": "CVE-2026-63885",
      "initial_release_date": "2026-07-19T00:00:00+00:00",
      "product_status:known_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: drm/gem: fix race between change_handle and handle_delete",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-63885.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-07-21T13:04:15Z",
      "cve": "CVE-2026-63885",
      "id": "CVE-2026-63885",
      "initial_release_date": "2026-07-21T13:04:15Z",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-63885",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-63885.json",
      "version": "2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.