CVE-2026-46215
drm: Set old handle to NULL before prime swap in change_handle
Description
In the Linux kernel, the following vulnerability has been resolved: drm: Set old handle to NULL before prime swap in change_handle There was a potential race condition in change_handle. The ioctl briefly had a single object with two idr entries; a concurrent gem_close could delete the object and remove one of the handles while leaving the other one dangling, which could subsequently be dereferenced for a use-after-free. To fix this, do the same dance that gem_close itself does. (f6cd7daecff5 drm: Release driver references to handle before making it available again) First idr_replace the old handle to NULL. Later, if the prime operations are successful, actually close it. create_tail required a similar dance to avoid a similar problem. (bd46cece51a3 drm/gem: Fix race in drm_gem_handle_create_tail()) It idr_allocs the new handle with NULL, then swaps in the correct object later to avoid races. We don't need to do that here, since the only operations that could race are drm_prime, and change_handle holds the prime lock for the entire duration. v2: cleanups of error paths
INFO
Published Date :
May 28, 2026, 10:16 a.m.
Last Modified :
July 10, 2026, 5:16 a.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 3.1 | HIGH | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
Solution
- Update the Linux kernel to the latest stable version.
- Apply provided patches for the DRM subsystem.
- Rebuild and install the kernel.
- Reboot the system to load the new kernel.
Public PoC/Exploit Available at Github
CVE-2026-46215 has a 9 public
PoC/Exploit available at Github.
Go to the Public Exploits tab to see the list.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-46215.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-46215 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-46215
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
CVE-2026-46215 DRM GEM UAF Exploit for Linux 7.0 - by Antonius (sw0rdm4n, w1sdom, ev1lut10n)
Makefile C
This is an exploit for CVE-2026-46215 (Linux Kernel Use After Free) Adapted for Linux 7.0 !!! by Antonius (ev1lut10n / sw0rdm4n)
Makefile C
UAF Exploitation in The Sheaves Era - The Artifacts - by : Antonius (w1sdom/ev1lut10n/sw0rdm4n) - bluedragonsec.com
Shell C Makefile Python
None
C Shell
An eBPF LSM program to filter user actions on HPC systems
ebpf
Rust C Shell Dockerfile
Audit CVE impact, patch status, remediation progress, and verification results across systems.
Makefile Go
my new and old exploit collections
C Python Shell Makefile
收集各种有趣的github项目
C C++ PowerShell Python Shell
📡 PoC auto collect from GitHub. ⚠️ Be careful Malware.
security cve exploit poc vulnerability
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-46215 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-46215 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Jul. 10, 2026
Action Type Old Value New Value Changed SSVC {'id': 'CVE-2026-46215', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'poc'}, {'automatable': 'no'}, {'technicalImpact': 'total'}], 'version': '2.0.3', 'timestamp': '2026-07-09T17:58:20.077435Z'} {'id': 'CVE-2026-46215', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'poc'}, {'automatable': 'no'}, {'technicalImpact': 'total'}], 'version': '2.0.3', 'timestamp': '2026-07-09T00:00:00+00:00'} -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Jul. 09, 2026
Action Type Old Value New Value Added Reference https://github.com/0xCyberstan/CVE-2026-46215-POC Added SSVC {'id': 'CVE-2026-46215', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'poc'}, {'automatable': 'no'}, {'technicalImpact': 'total'}], 'version': '2.0.3', 'timestamp': '2026-07-09T17:58:20.077435Z'} -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jun. 17, 2026
Action Type Old Value New Value Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '53096728b8910c6916ecc6c46a5abc5c678b58d9', 'lessThan': '672464dd53231509c9c771110798c56d4660e19e', 'versionType': 'git'}, {'status': 'affected', 'version': '53096728b8910c6916ecc6c46a5abc5c678b58d9', 'lessThan': '61bd96d3e5472c253f9c1ab77608f0c8aaa9d025', 'versionType': 'git'}, {'status': 'affected', 'version': '53096728b8910c6916ecc6c46a5abc5c678b58d9', 'lessThan': '5e28b7b94408897e41c63477aabc9e1db439bc8c', 'versionType': 'git'}], 'programFiles': ['drivers/gpu/drm/drm_gem.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '6.18'}, {'status': 'unaffected', 'version': '0', 'lessThan': '6.18', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '6.18.32', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.0.9', 'versionType': 'semver', 'lessThanOrEqual': '7.0.*'}, {'status': 'unaffected', 'version': '7.1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['drivers/gpu/drm/drm_gem.c'], 'defaultStatus': 'affected'}] -
Initial Analysis by [email protected]
Jun. 10, 2026
Action Type Old Value New Value Added CWE CWE-416 Added CPE Configuration OR *cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.18 up to (excluding) 6.18.32 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.19 up to (excluding) 7.0.9 Added Reference Type kernel.org: https://git.kernel.org/stable/c/5e28b7b94408897e41c63477aabc9e1db439bc8c Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/61bd96d3e5472c253f9c1ab77608f0c8aaa9d025 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/672464dd53231509c9c771110798c56d4660e19e Types: Patch -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
May. 30, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H -
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
May. 28, 2026
Action Type Old Value New Value Added Description In the Linux kernel, the following vulnerability has been resolved: drm: Set old handle to NULL before prime swap in change_handle There was a potential race condition in change_handle. The ioctl briefly had a single object with two idr entries; a concurrent gem_close could delete the object and remove one of the handles while leaving the other one dangling, which could subsequently be dereferenced for a use-after-free. To fix this, do the same dance that gem_close itself does. (f6cd7daecff5 drm: Release driver references to handle before making it available again) First idr_replace the old handle to NULL. Later, if the prime operations are successful, actually close it. create_tail required a similar dance to avoid a similar problem. (bd46cece51a3 drm/gem: Fix race in drm_gem_handle_create_tail()) It idr_allocs the new handle with NULL, then swaps in the correct object later to avoid races. We don't need to do that here, since the only operations that could race are drm_prime, and change_handle holds the prime lock for the entire duration. v2: cleanups of error paths Added Reference https://git.kernel.org/stable/c/5e28b7b94408897e41c63477aabc9e1db439bc8c Added Reference https://git.kernel.org/stable/c/61bd96d3e5472c253f9c1ab77608f0c8aaa9d025 Added Reference https://git.kernel.org/stable/c/672464dd53231509c9c771110798c56d4660e19e