CVE-2026-63885

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A race condition exists between the drm gem change handle ioctl and drm gem handle delete functions. The drm gem change handle ioctl function leaves an old handle active in the IDR (Integer ID Management) during the interval between spin unlock(table lock) and the final spin lock(table lock). If a concurrent drm gem handle delete operation occurs on the old handle during this window, it can successfully decrement the handle count to 0 and free the GEM (Graphics Execution Manager) object while the new handle's IDR entry still references it.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.