CVE-2026-46215

A flaw was found in the Linux kernel. A race condition in the Direct Rendering Manager (DRM) subsystem's change_handle function could allow a local attacker to trigger a use-after-free vulnerability. This occurs when a concurrent gem_close operation removes one handle while another remains dangling. Successful exploitation of this flaw could lead to arbitrary code execution or privilege escalation.

This Important flaw in the Linux kernel's Direct Rendering Manager (DRM) subsystem could allow a local attacker to achieve arbitrary code execution or privilege escalation due to a race condition in the change_handle function. This vulnerability arises from a use-after-free scenario when handling graphics memory, specifically when a gem_close operation occurs concurrently with handle changes, leaving a dangling reference.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent module drm from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.