PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46215 Linux CVE debrief

A use-after-free vulnerability in the Linux kernel's Direct Rendering Manager (DRM) subsystem has been resolved. The flaw existed in the `change_handle` function, where a race condition could occur during prime handle swapping. The ioctl temporarily created a single GEM object with two IDR entries; a concurrent `gem_close` operation could delete the object and remove one handle while leaving the other dangling, leading to potential use-after-free when subsequently dereferenced. The fix mirrors the approach used in `gem_close` and `drm_gem_handle_create_tail`: the old handle is first replaced with NULL in the IDR, and only closed after successful prime operations. This prevents the race window where a dangling handle could exist. The vulnerability was published on 2026-05-28 and affects the Linux kernel DRM subsystem. No CVSS score has been assigned as of the CVE publication date.

Vendor
Linux
Product
Unknown
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-28
Original CVE updated
2026-07-10
Advisory published
2026-05-28
Advisory updated
2026-07-10

Who should care

Linux system administrators, kernel maintainers, and organizations running multi-user systems with GPU access where untrusted users may execute graphics workloads. Cloud providers and desktop environments using DRM prime buffer sharing should prioritize assessment.

Technical summary

The vulnerability is a use-after-free in the Linux kernel's DRM subsystem, specifically in the `change_handle` function used for prime handle operations. The root cause is a race condition where the ioctl temporarily creates two IDR entries pointing to the same GEM object. A concurrent `gem_close` could free the object while one handle remains, leading to use-after-free. The fix implements a two-phase update: first replace the old handle with NULL in the IDR (preventing concurrent lookup), then perform prime operations, and finally close the old handle only on success. This pattern follows prior fixes in `gem_close` (commit f6cd7daecff5) and `drm_gem_handle_create_tail` (commit bd46cece51a3). The change_handle function holds the prime lock throughout, eliminating the need for the full allocation-then-swap pattern used in create_tail.

Defensive priority

medium

Recommended defensive actions

  • Apply kernel patches from stable commits when available for your distribution
  • Monitor Linux distribution security advisories for backported fixes
  • Review systems using DRM prime buffer sharing for potential exposure
  • Prioritize patching on multi-user systems where untrusted users can execute GPU workloads

Evidence notes

The vulnerability description is sourced from the official CVE record published by NVD on 2026-05-28. The fix references three kernel.org stable commits. The vendor identification is marked as low confidence ('Unknown Vendor') with 'Kernel' as a candidate domain, requiring review.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-46215 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-46215

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-46215 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-46215

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/5e28b7b94408897e41c63477aabc9e1db439bc8c

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/61bd96d3e5472c253f9c1ab77608f0c8aaa9d025

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/672464dd53231509c9c771110798c56d4660e19e

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.