CVE-2026-52966: Linux Kernel Privilege Escalation Flaw

CVE-2026-52966 Overview

CVE-2026-52966 is a Linux kernel vulnerability in the Direct Rendering Manager (DRM) subsystem. The flaw stems from a logical error introduced by commit 5e28b7b94408, which failed to replace the newly generated IDR pointer with the old id's pointer at the correct location inside the change handle logic. The defect was surfaced by syzbot through a kernel warning in drm_prime_destroy_file_private at drivers/gpu/drm/drm_prime.c:224. The fix ensures the new IDR object pointer correctly replaces the original id's pointer during normal execution flow and removes an unnecessary conditional check on the return exit path.

Critical Impact
Local processes interacting with DRM PRIME buffer handles can trigger a kernel warning and leave stale dmabufs entries, causing kernel state inconsistency in the graphics subsystem.

Affected Products

Linux kernel versions containing commit 5e28b7b94408 prior to the fix
Linux stable branches receiving the backported patches 318b995cffcf, 38f12d0e10d8, and dc366607c41c
Distributions shipping the affected mainline DRM subsystem

Discovery Timeline

2026-06-24 - CVE-2026-52966 published to NVD
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-52966

Vulnerability Analysis

The issue resides in the DRM PRIME handle management code, which uses an IDR (ID Radix tree) to map integer handles to GEM object pointers exported as DMA buffers. The faulty commit modified the change handle logic but did not move the new IDR pointer into the slot previously occupied by the old id. As a result, the radix tree retains an inconsistent mapping after a handle change operation.

When the file descriptor is released, drm_file_free invokes drm_prime_destroy_file_private, which asserts that the per-file dmabufs red-black tree is empty. Because the prior logic left orphaned entries referenced through the stale mapping, the kernel triggers WARNING: drivers/gpu/drm/drm_prime.c:224 with the message !RB_EMPTY_ROOT(&prime_fpriv->dmabufs). The call path observed by syzbot traverses drm_release → drm_close_helper → drm_file_free.

Root Cause

The root cause is an incorrect pointer replacement in IDR bookkeeping inside the DRM PRIME change handle path introduced by commit 5e28b7b94408. The new IDR object pointer was not written back to the original id's location, breaking the invariant that PRIME handle entries and the dmabufs red-black tree remain consistent across operations.

Attack Vector

The attack vector requires local access to a DRM device node such as /dev/dri/card0. A process that performs PRIME buffer import/export operations exercising the change handle code path can drive the file private state into an inconsistent condition. On file close, the kernel emits a warning and leaves residual graphics buffer state. No remote vector or authenticated network surface is involved. Refer to the upstream fix commits for the exact code paths: Kernel Git Commit 318b995, Kernel Git Commit 38f12d0, and Kernel Git Commit dc36660.

Detection Methods for CVE-2026-52966

Indicators of Compromise

Kernel log entries containing !RB_EMPTY_ROOT(&prime_fpriv->dmabufs) originating from drm_prime_destroy_file_private.
Warnings referencing drivers/gpu/drm/drm_prime.c:224 in dmesg or journal output.
Repeated stack traces showing drm_file_free → drm_close_helper → drm_release near process exit events.

Detection Strategies

Monitor kernel ring buffers for DRM PRIME warnings and correlate them with the originating process and DRM device.
Audit running kernel versions across the fleet and flag hosts on builds that include commit 5e28b7b94408 but lack the fix commits listed in the references.
Track abnormal use of /dev/dri/* nodes by non-graphics workloads, which can indicate fuzzing or targeted exercise of the PRIME path.

Monitoring Recommendations

Forward dmesg and kern.log to centralized logging and alert on DRM WARNING patterns.
Baseline expected DRM activity per host and surface deviations from sandboxed or container workloads.
Include the affected file drivers/gpu/drm/drm_prime.c in kernel patch compliance reporting.

How to Mitigate CVE-2026-52966

Immediate Actions Required

Apply the upstream stable kernel updates that include commits 318b995cffcf, 38f12d0e10d8, and dc366607c41c.
Inventory all Linux hosts and identify kernels containing the regressing commit 5e28b7b94408 without the fix.
Restrict local access to DRM device nodes for untrusted users and sandboxed workloads where graphics access is not required.

Patch Information

The Linux kernel maintainers resolved the issue by ensuring the new IDR object pointer replaces the original id's pointer at the correct location in the change handle logic and by removing an unnecessary conditional on the return exit path. Patches are available at Kernel Git Commit 318b995, Kernel Git Commit 38f12d0, and Kernel Git Commit dc36660.

Workarounds

Tighten permissions on /dev/dri/* to limit DRM PRIME access to trusted graphics users only.
Disable or unload DRM drivers on systems that do not require GPU acceleration, such as headless servers.
Run untrusted local workloads inside containers or VMs without passthrough access to DRM devices.

bash

# Verify installed kernel and check for the fix commits
uname -r
rpm -q --changelog kernel | grep -E '318b995|38f12d0|dc36660' || echo 'Fix not present - update required'

# Restrict DRM device access to the video group
chgrp video /dev/dri/card*
chmod 0660 /dev/dri/card*