CVE-2026-53145

취약점 유형

In the Linux kernel, the following vulnerability has been resolved: drm/gem: Try to fix change_handle ioctl, attempt 4 [airlied: just added some comments on how to reenable] On-list because the cat is out of the bag and we're clearly not good enough to figure this out in private. The story thus far: 5e28b7b94408 ("drm: Set old handle to NULL before prime swap in change_handle") tried to fix a race condition between the gem_close and gem_change_handle ioctls, but got a few things wrong: - There's a confusion with the local variable handle, which is actually the new handle, and so the two-stage trick was actually applied to the wrong idr slot. 7164d78559b0 ("drm/gem: fix race between change_handle and handle_delete") tried to fix that by adding yet another code block, but forgot to add the error handling. Which meant we now have two paths, both kinda wrong. - dc366607c41c ("drm: Replace old pointer to new idr") tried to apply another fix, but inconsistently, again because of the handle confusion - this would be the right fix (kinda, somewhat, it's a mess) if we'd do the two-stage approach for the new handle. Except that wasn't the intent of the original fix. We also didn't have an ig

영향받는 제품

• linux linux_kernel
• redhat enterprise_linux

참고 자료

• https://git.kernel.org/stable/c/1a4f03d22fb655e5f192244fb2c87d8066fcfca2
• https://git.kernel.org/stable/c/1d9b93df7fc768228906e24220591ec1cddad391
• https://git.kernel.org/stable/c/c0639ede2f24ac224b2079cd35ecd5fd8ad4e3cd
• https://access.redhat.com/security/cve/CVE-2026-53145
• https://bugzilla.redhat.com/show_bug.cgi?id=2492773
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53145.json