Linux Kernel CVE-2026-63885

Apply the vendor patch by upgrading to a fixed stable kernel: 6.18.35 or later on the 6.18.x branch, or 7.0.12 or later on the 7.0.x branch (Vendor-released patch confirmed via kernel.org stable commits). The fix NULLs the old handle's IDR entry before dropping table_lock so a concurrent GEM_CLOSE sees NULL and returns -EINVAL, and restores the entry on the prime-bookkeeping error path; cherry-pick commits 0dfa42cfe4db, cde2c9257cbe, or 7164d78559b0 if you maintain a custom tree. Where kernel updates cannot be applied immediately, the practical compensating control is to restrict access to DRM device nodes (/dev/dri/card* and renderD*) by tightening group membership (video/render) and limiting untrusted local/interactive users, since exploitation requires local access to those devices - the trade-off is that this can break graphics, GPU compute, and container GPU passthrough for restricted users. There is no network-facing mitigation because the flaw is local-only.