CVE-2026-63885

Last refreshed2026-10-17

Status: UPDATED | Advisory ID: CVE-2026-63885

Key Details

CVE	CVE-2026-63885
CVSS Score / Version	8.8 (High) / CVSS v3.1
Updated	2026-10-16
CVSS Vector	`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H`
CVSS Prose	attack vector is local; attack complexity is low; privileges required is low; user interaction is none; scope is changed; confidentiality impact is high; integrity impact is high; availability impact is high.
Affected products	Linux Kernel

Vendor	Product	Affected Versions	Patch Status
Linux	Linux Kernel

Vendor

Product

Affected Versions

Patch Status

Linux

Linux Kernel

Subsystems	OT Supporting Infrastructure
Sectors	All Sectors

In the Linux kernel, the following vulnerability has been resolved:

drm/gem: fix race between change_handle and handle_delete

drm_gem_change_handle_ioctl leaves the old handle live in the IDR

during the window between spin_unlock(table_lock) and the final

spin_lock(table_lock). A concurrent drm_gem_handle_delete on the old

handle succeeds in this window, decrements handle_count to 0, and frees

the GEM object while the new handle's IDR entry still references it.

NULL the old handle's IDR entry before dropping table_lock so that any

concurrent GEM_CLOSE on the old handle sees NULL and returns -EINVAL.

Restore the old entry on the prime-bookkeeping error path. (NVD)

Monitor Linux's web page for any future patch releases.

Source	Reference
NVD	https://nvd.nist.gov/vuln/detail/CVE-2026-63885
CVE	https://www.cve.org/CVERecord?id=CVE-2026-63885

Source

Reference

NVD

CVE