A newly patched Linux kernel vulnerability, tracked as CVE-2026-46215, allowed any local user with access to a GPU render node to escalate privileges to root, without requiring any special permissions.
The flaw affected mainline kernels from v6.18-rc1 through the fix, and was reported to security@kernel.org on 12 April 2026, with a patch landing in late May 2026.
The bug is a use-after-free in the DRM GEM core ioctl DRM_IOCTL_GEM_CHANGE_HANDLE, added in v6.18-rc1 for AMD’s CRIU checkpoint/restore work.
This ioctl moves a graphics buffer object from one handle to another but never updates the object’s handle_count. During a brief window, the object has two IDR (ID lookup) entries while its handle count still reads 1.
If a second thread calls DRM_IOCTL_GEM_CLOSE on the old handle during that window, it drives the count to 0 and frees the object while the new handle still points to the now-freed memory.
Both ioctls carry the DRM_RENDER_ALLOW flag, meaning any process that can open /dev/dri/renderD* can trigger the race. On most desktop Linux systems, systemd-logind grants this access to any logged-in user by default.
From Race Condition to Root
The Cyberstan proof-of-concept chains several techniques to turn the freed object into full root access:
- Reclaims the freed memory slot using a sprayed array of
pipe_bufferstructures - Leaks a kernel pointer through overlapping struct fields to defeat KASLR
- Sets
PIPE_BUF_FLAG_CAN_MERGEvia a GEM object naming trick, bypassing the 2022 DirtyPipe fix - Overwrites the read-only
/etc/passwdfile through the page cache, removing root’s password field
Across 100 test boots, the exploit succeeded 99 times, taking on average under 100 race iterations to win.
Researcher Puttimet Thammasaeng reported the same bug first before Cyberstan and received the official CVE credit and upstream “Reported-by” attribution. The author of this analysis discovered and reported it independently, contributing separate exploit research.
AMD’s David Francis and kernel maintainer Dave Airlie shipped a fix that closes the race window with a two-stage idr_replace operation, rolling back cleanly if a concurrent close wins the race.
Kernel maintainers went further, disabling the GEM_CHANGE_HANDLE ioctl entirely in the upcoming 7.1 release, removing the vulnerable code path altogether. Fixed versions are 6.18.32, 7.0.9, and 7.1-rc3 onward.
The vulnerability illustrates a recurring kernel bug pattern: compound operations on refcounted objects in which a reference is added, removed, and counted in separate steps, creating windows where concurrent teardown can free memory still in use, as the Cyberstan advisory notes.
Subsystems that skip established helper functions for this bookkeeping remain at risk of similar race conditions.
Stop Accepting SLAs Written for 2019 SOCs – Here’s the 2026 AI SLA Vendor Checklist – Download Free AI SOC SLA Guide
