CVE-2026-89823

A flaw was found in the Linux kernel's Direct Rendering Manager (DRM) subsystem. A race condition exists during the partial failure of drm_dev_register() when a minor device is registered but the primary minor fails. A local user could exploit this by opening the registered minor device and initiating an ioctl operation. This allows the ioctl to proceed while device resources are being torn down, potentially leading to a denial of service (DoS) due to resource mismanagement.

A race in drm_dev_register can occur when registration fails after at least one DRM minor has already been registered. A local userspace process may open that minor and enter a drm_dev_enter critical section while the error path starts tearing down device resources. Because the unplugged flag was not set on this failure path, an ioctl may continue to run against a device that is being cleaned up. This creates a plausible use after free style condition rather than a simple warning or pure resource leak. For the CVSS the PR:L value is used because access to DRM render nodes is commonly delegated to local users through render or video group membership or desktop session policy. The issue is not network reachable and requires local access to the DRM device node. Impact is at least local denial of service via kernel crash and in worst case may allow confidentiality or integrity impact due to memory corruption, so it should be reviewed manually.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.