CVE-2026-23149: Linux Kernel Privilege Escalation Flaw

CVE-2026-23149 Overview

CVE-2026-23149 is a medium-severity vulnerability in the Linux kernel Direct Rendering Manager (DRM) subsystem. The flaw resides in the drm_gem_change_handle_ioctl() function, which handles Graphics Execution Manager (GEM) buffer object handles. Userspace can pass a new handle value larger than INT_MAX, triggering a WARN_ON_ONCE() inside idr_alloc() and producing kernel warnings.

GEM buffer object handles are exposed as u32 in the userspace API, but the internal implementation uses idr_alloc(), which operates on signed int ranges. This type mismatch allows a local unprivileged user to spam the kernel log and potentially affect system availability.

Critical Impact
A local user with access to the DRM IOCTL interface can trigger kernel warnings and impact system availability through repeated invocation.

Affected Products

Linux Kernel 6.19-rc1 through 6.19-rc7
Mainline Linux kernel builds incorporating the vulnerable drm_gem_change_handle_ioctl() code path
Distributions shipping pre-release 6.19 kernels with DRM enabled

Discovery Timeline

2026-02-14 - CVE-2026-23149 published to NVD
2026-03-17 - Last updated in NVD database

Technical Details for CVE-2026-23149

Vulnerability Analysis

The vulnerability stems from improper input validation in the DRM GEM handle change IOCTL. The userspace API exposes GEM buffer object handles as unsigned 32-bit integers (u32), but the kernel's internal IDR (ID Radix tree) allocator uses signed int values. When userspace supplies a new handle value greater than INT_MAX, the value becomes negative when interpreted by idr_alloc().

The idr_alloc() function contains a defensive check: if (WARN_ON_ONCE(start < 0)) return -EINVAL;. This check fires whenever the converted start value is negative, emitting a kernel warning to the log. While the operation correctly returns -EINVAL, the WARN_ON_ONCE macro produces a stack trace and pollutes dmesg output.

The issue falls under improper input validation [NVD-CWE-noinfo] and produces an availability impact by enabling unprivileged users to spam kernel logs or trigger panic_on_warn configurations.

Root Cause

The root cause is a type domain mismatch between the userspace API (u32) and the internal kernel allocator (int). The function failed to validate that the user-supplied handle value fits within the signed integer range before passing it to idr_alloc(). The fix rejects new handles above INT_MAX and recalculates the end limit in the int domain to make the bounds check explicit.

Attack Vector

Exploitation requires local access and the ability to issue DRM IOCTLs against a GEM-capable device node such as /dev/dri/card0. An attacker invokes the DRM_IOCTL_GEM_CHANGE_HANDLE operation with a new handle value greater than INT_MAX (0x7FFFFFFF). The kernel reaches the idr_alloc() call, triggers WARN_ON_ONCE, and emits a warning. Systems configured with panic_on_warn=1 will halt, producing a denial-of-service condition.

No verified public exploit code is available. The vulnerability mechanism is described in the upstream kernel commits referenced in the Linux Kernel Commit and Linux Kernel Commit.

Detection Methods for CVE-2026-23149

Indicators of Compromise

Kernel log entries containing WARN_ON_ONCE stack traces originating from idr_alloc() invoked via the DRM GEM code path
Repeated -EINVAL returns from DRM_IOCTL_GEM_CHANGE_HANDLE calls in audit logs
Unexpected kernel panics on systems with panic_on_warn enabled following userspace DRM activity

Detection Strategies

Monitor dmesg and /var/log/kern.log for warning traces referencing drm_gem_change_handle_ioctl and idr_alloc
Use auditd rules to track IOCTL invocations against /dev/dri/* device nodes from unprivileged processes
Correlate kernel warning bursts with process identifiers to identify potential abuse

Monitoring Recommendations

Enable kernel audit subsystem rules for the DRM device class and review IOCTL frequency by user identity
Forward kernel logs to a centralized SIEM and alert on WARN_ON_ONCE traces from graphics subsystem code
Track running kernel version inventory and flag hosts on Linux 6.19 release candidates

How to Mitigate CVE-2026-23149

Immediate Actions Required

Update to a Linux kernel build containing commits 12f15d52d38a and ae8831ee0fb2, which add the INT_MAX bounds check
Restrict access to /dev/dri/* device nodes by enforcing group membership and tightening filesystem permissions
Disable panic_on_warn on production systems where availability is critical until patched kernels are deployed

Patch Information

The upstream fix is delivered through two commits in the kernel stable tree. The patch rejects new handle values above INT_MAX in drm_gem_change_handle_ioctl() and recalculates the IDR end limit in the int domain. Reference the Linux Kernel Commit 12f15d52 and Linux Kernel Commit ae8831ee for the verified source changes.

Workarounds

Limit DRM device access to trusted users by adjusting the video and render group membership
Set sysctl kernel.panic_on_warn=0 to prevent the warning from escalating to a system halt
Apply seccomp filters to untrusted workloads to block the ioctl syscall against DRM device nodes

bash

# Configuration example
# Restrict DRM device access to the render group
chgrp render /dev/dri/card0 /dev/dri/renderD128
chmod 0660 /dev/dri/card0 /dev/dri/renderD128

# Disable panic_on_warn until patched kernel is deployed
sysctl -w kernel.panic_on_warn=0

# Verify running kernel version
uname -r