CVE-2026-53145: Linux Kernel Race Condition Vulnerability

CVE-2026-53145 is a race condition vulnerability in the Linux kernel's DRM GEM subsystem affecting the change_handle ioctl. This flaw allows potential conflicts between gem_close and gem_change_handle operations. This article covers technical details, affected versions, impact, and mitigation strategies.

CVE-2026-53145 Overview

CVE-2026-53145 affects the Linux kernel's Direct Rendering Manager (DRM) Graphics Execution Manager (GEM) subsystem. The vulnerability stems from a race condition in the change_handle ioctl, which interacts unsafely with concurrent gem_close and handle_delete operations. Multiple prior patches attempted to address the race but introduced additional issues including incorrect IDR slot handling, missing error paths, and inconsistent fixes. The kernel maintainers ultimately disabled the ioctl pending further review and integration test (IGT) coverage. The vulnerability was published on June 25, 2026.

Critical Impact
A local attacker invoking the DRM GEM change_handle ioctl concurrently with gem_close can trigger a race condition affecting kernel object reference handling in the IDR subsystem.

Affected Products

Linux kernel DRM subsystem (drm/gem)
Kernel builds incorporating commits 5e28b7b94408, 7164d78559b0, and dc366607c41c
Distributions shipping the affected DRM GEM change_handle ioctl implementation

Discovery Timeline

2026-06-25 - CVE-2026-53145 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-53145

Vulnerability Analysis

The flaw exists in the DRM GEM change_handle ioctl, which allows userspace to swap or rename GEM object handles. The original fix in commit 5e28b7b94408 attempted to set the old handle to NULL before performing a prime swap. However, a local variable naming collision between the new handle and args->handle caused the two-stage idr_replace trick to operate on the wrong IDR slot.

Subsequent commits 7164d78559b0 and dc366607c41c introduced partial corrections but omitted error handling and applied fixes inconsistently. The result was two parallel code paths, both incorrect, leaving the race condition exploitable [CWE-362]. A concurrent gem_close on the new handle could steal the inherited IDR reference, creating an unsafe state in kernel object lifecycle management.

Root Cause

The root cause is a Time-of-Check Time-of-Use (TOCTOU) race between gem_change_handle and gem_close ioctls. The local variable handle was confused with args->handle, causing the two-stage IDR replacement pattern to operate against an incorrect slot. The error path for idr_replace also failed to validate results with IS_ERR_OR_NULL, mirroring the check pattern in gem_handle_delete.

Attack Vector

A local user with access to a DRM device node can invoke the change_handle ioctl concurrently with gem_close on overlapping handle values. The race window allows a concurrent close operation to steal the IDR-inherited reference, leading to inconsistent kernel state. The remediation merges the GEM object lookup with the two-stage idr_replace operation and renames the local variable to new_handle to eliminate aliasing confusion. The ioctl has been disabled entirely until comprehensive IGT coverage and consensus review are completed.

The vulnerability mechanism is documented in the upstream patch commits. See the Kernel Git Commit Update for the full patch series.

Detection Methods for CVE-2026-53145

Indicators of Compromise

Unexpected kernel warnings or oops referencing drm_gem, idr_replace, or gem_handle_delete in dmesg or /var/log/kern.log
Userspace processes invoking the DRM change_handle ioctl on kernels predating the fix
Anomalous DRM device file descriptor activity from unprivileged processes

Detection Strategies

Audit running kernel versions across the fleet and compare against the patched stable commits 1a4f03d22fb6, 1d9b93df7fc7, and c0639ede2f24
Monitor auditd for ioctl syscalls targeting /dev/dri/card* and /dev/dri/renderD* device nodes from non-graphical processes
Review kernel ring buffer logs for DRM GEM-related warnings or reference counting anomalies

Monitoring Recommendations

Track kernel crash and oops telemetry centrally to surface DRM subsystem regressions
Baseline expected DRM ioctl usage per workload and alert on deviations from non-graphical workloads
Correlate local process behavior with DRM device access patterns to identify suspicious enumeration

How to Mitigate CVE-2026-53145

Immediate Actions Required

Apply the latest stable Linux kernel update containing the patches referenced in the kernel.org commits
Inventory systems running affected kernel versions and prioritize multi-user or container hosts
Restrict access to DRM device nodes to trusted user groups where graphics access is not broadly required

Patch Information

The fix is distributed across three upstream stable commits: Kernel Commit 1a4f03d22fb6, Kernel Commit 1d9b93df7fc7, and Kernel Commit c0639ede2f24. The patch renames the local variable to new_handle, merges GEM object lookup with the two-stage idr_replace, corrects error handling using IS_ERR_OR_NULL, and disables the change_handle ioctl until IGT coverage is complete.

Workarounds

Disable or restrict access to the DRM change_handle ioctl through kernel configuration where the patched ioctl-disable behavior is not yet present
Apply mandatory access control policies (SELinux, AppArmor) to limit which processes can open DRM device nodes
On multi-tenant hosts, restrict /dev/dri/* permissions to the video or render group only

bash

# Restrict DRM device access to the render group
sudo chgrp render /dev/dri/renderD*
sudo chmod 0660 /dev/dri/renderD*

# Verify currently running kernel version against patched commits
uname -r