CVE-2026-63885: Linux

High severity, CVSS 8.8. EPSS: 0.2% chance of exploitation in the next 30 days.

In the Linux kernel, the following vulnerability has been resolved: drm/gem: fix race between change_handle and handle_delete drm_gem_change_handle_ioctl leaves the old handle live in the IDR during the window between spin_unlock(table_lock) and the final spin_lock(table_lock). A concurrent drm_gem_handle_delete on the old handle succeeds in this window, decrements handle_count to 0, and frees the GEM object while the new handle's IDR entry still references it. NULL the old handle's IDR entry before dropping table_lock so that any concurrent GEM_CLOSE on the old handle sees NULL and returns -EINVAL. Restore the old entry on the prime-bookkeeping error path.

Affected products

• Linux Linux: from 6.18.32, before 6.18.35 (fixed in 6.18.35); from 7.0.9, before 7.0.12 (fixed in 7.0.12)

Published 2026-07-19. Last modified 2026-07-27.