CVE-2026-53145

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

drm/gem: Try to fix change_handle ioctl, attempt 4

[airlied: just added some comments on how to reenable]

On-list because the cat is out of the bag and we're clearly not good

enough to figure this out in private. The story thus far:

5e28b7b94408 ("drm: Set old handle to NULL before prime swap in

change_handle") tried to fix a race condition between the gem_close and

gem_change_handle ioctls, but got a few things wrong:

- There's a confusion with the local variable handle, which is actually

the new handle, and so the two-stage trick was actually applied to the

wrong idr slot. 7164d78559b0 ("drm/gem: fix race between

change_handle and handle_delete") tried to fix that by adding yet

another code block, but forgot to add the error handling. Which meant

we now have two paths, both kinda wrong.

- dc366607c41c ("drm: Replace old pointer to new idr") tried to apply

another fix, but inconsistently, again becaus

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References