---
id: CVE-2026-63885
title: 'drm/gem: fix race between change_handle and handle_delete'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  drm/gem: fix race between change_handle and handle_delete

  drm_gem_change_handle_ioctl leaves the old handle live in the IDR
  during the window between spin_unlock(table…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 672464dd53231509c9c771110798c56d4660e19e <
    0dfa42cfe4dbe114533480503934f43e33c1e83d
  - >-
    Linux >= 61bd96d3e5472c253f9c1ab77608f0c8aaa9d025 <
    cde2c9257cbe8463b9dcf7b1075177b72b5fd938
  - >-
    Linux >= 5e28b7b94408897e41c63477aabc9e1db439bc8c <
    7164d78559b0ff29931a366a840a9e5dd53d4b7c
  - Linux >= 6.18.32 < 6.18.35
  - Linux >= 7.0.9 < 7.0.12
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T15:32:52.253073Z'
published: '2026-07-19'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:42:09.874Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-63885'
references:
  - url: 'https://git.kernel.org/stable/c/0dfa42cfe4dbe114533480503934f43e33c1e83d'
  - url: 'https://git.kernel.org/stable/c/cde2c9257cbe8463b9dcf7b1075177b72b5fd938'
  - url: 'https://git.kernel.org/stable/c/7164d78559b0ff29931a366a840a9e5dd53d4b7c'
tags:
  - cve.org
epss: 0.00173
epssPercentile: 0.06314
ingestedAt: '2026-10-16T17:24:46.772Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

drm/gem: fix race between change_handle and handle_delete

drm_gem_change_handle_ioctl leaves the old handle live in the IDR
during the window between spin_unlock(table_lock) and the final
spin_lock(table_lock). A concurrent drm_gem_handle_delete on the old
handle succeeds in this window, decrements handle_count to 0, and frees
the GEM object while the new handle's IDR entry still references it.

NULL the old handle's IDR entry before dropping table_lock so that any
concurrent GEM_CLOSE on the old handle sees NULL and returns -EINVAL.
Restore the old entry on the prime-bookkeeping error path.

## Affected

- `Linux >= 672464dd53231509c9c771110798c56d4660e19e < 0dfa42cfe4dbe114533480503934f43e33c1e83d`
- `Linux >= 61bd96d3e5472c253f9c1ab77608f0c8aaa9d025 < cde2c9257cbe8463b9dcf7b1075177b72b5fd938`
- `Linux >= 5e28b7b94408897e41c63477aabc9e1db439bc8c < 7164d78559b0ff29931a366a840a9e5dd53d4b7c`
- `Linux >= 6.18.32 < 6.18.35`
- `Linux >= 7.0.9 < 7.0.12`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.