Baitaphish
Security intelligence
SearchLatest briefing
CVE Explorer

CVE-2026-63885

In the Linux kernel, the following vulnerability has been resolved: drm/gem: fix race between change_handle and handle_delete drm_gem_change_handle_ioctl leaves the old handle live in the IDR during the window between spin_unlock(table_lock) and the final spin_lock(table_lock). A concurrent drm_gem_handle_delete on the old handle succeeds in this window, decrements handle_count to 0, and frees the GEM object while the new handle's IDR entry still references it. NULL the old handle's IDR entry
Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:e785332d3b886bd1963fc2bf421088a489267a20eacb4e23363af757a7e135c2
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
1

Preserved source conflicts

No provider value was silently selected as the winner.

affected · 2 assertions

{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/gpu/drm/drm_gem.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"0dfa42cfe4dbe114533480503934f43e33c1e83d","status":"affected","version":"672464dd53231509c9c771110798c56d4660e19e","versionType":"git"},{"lessThan":"cde2c9257cbe8463b9dcf7b1075177b72b5fd938","status":"affected","version":"61bd96d3e5472c253f9c1ab77608f0c8aaa9d025","versionType":"git"},{"lessThan":"7164d78559b0ff29931a366a840a9e5dd53d4b7c","status":"affected","version":"5e28b7b94408897e41c6…

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:5633c7e05c47f71dd8d505b9a34ed41c0eaf9643de4dc35a7f034d402b462882 · sha256:9e85fab6788e67d6… · /containers/cna/affected/0

{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/gpu/drm/drm_gem.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"6.18.35","status":"affected","version":"6.18.32","versionType":"semver"},{"lessThan":"7.0.12","status":"affected","version":"7.0.9","versionType":"semver"}]}

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:5633c7e05c47f71dd8d505b9a34ed41c0eaf9643de4dc35a7f034d402b462882 · sha256:9e85fab6788e67d6… · /containers/cna/affected/1

Affected products and versions

2 source assertions
{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/gpu/drm/drm_gem.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"0dfa42cfe4dbe114533480503934f43e33c1e83d","status":"affected","version":"672464dd53231509c9c771110798c56d4660e19e","versionType":"git"},{"lessThan":"cde2c9257cbe8463b9dcf7b1075177b72b5fd938","status":"affected","version":"61bd96d3e5472c253f9c1ab77608f0c8aaa9d025","versionType":"git"},{"lessThan":"7164d78559b0ff29931a366a840a9e5dd53d4b7c","status":"affected","version":"5e28b7b94408897e41c6…
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:5633c7e05c47f71dd8d505b9a34ed41c0eaf9643de4dc35a7f034d402b462882 · sha256:9e85fab6788e67d6… · /containers/cna/affected/0
{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/gpu/drm/drm_gem.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"6.18.35","status":"affected","version":"6.18.32","versionType":"semver"},{"lessThan":"7.0.12","status":"affected","version":"7.0.9","versionType":"semver"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:5633c7e05c47f71dd8d505b9a34ed41c0eaf9643de4dc35a7f034d402b462882 · sha256:9e85fab6788e67d6… · /containers/cna/affected/1

Provider-owned CVSS observations

1 source assertion
{"metric":{"baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"metric_type":"cvssV3_1"}
  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:5633c7e05c47f71dd8d505b9a34ed41c0eaf9643de4dc35a7f034d402b462882 · sha256:9e85fab6788e67d6… · /containers/cna/metrics/0/cvssV3_1

Source references

3 source assertions
{"url":"https://git.kernel.org/stable/c/0dfa42cfe4dbe114533480503934f43e33c1e83d"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:5633c7e05c47f71dd8d505b9a34ed41c0eaf9643de4dc35a7f034d402b462882 · sha256:9e85fab6788e67d6… · /containers/cna/references/0
{"url":"https://git.kernel.org/stable/c/7164d78559b0ff29931a366a840a9e5dd53d4b7c"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:5633c7e05c47f71dd8d505b9a34ed41c0eaf9643de4dc35a7f034d402b462882 · sha256:9e85fab6788e67d6… · /containers/cna/references/2
{"url":"https://git.kernel.org/stable/c/cde2c9257cbe8463b9dcf7b1075177b72b5fd938"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:5633c7e05c47f71dd8d505b9a34ed41c0eaf9643de4dc35a7f034d402b462882 · sha256:9e85fab6788e67d6… · /containers/cna/references/1

Attribution and limitations

  • CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer