Linux Kernel EUVD-2026-38834

The vulnerability resides in drivers/gpu/drm/drm_prime.c within the Linux kernel's Direct Rendering Manager (DRM) PRIME buffer-sharing subsystem. PRIME enables GPU DMA-BUF sharing between DRM clients; each open DRM file private structure (drm_file) maintains a red-black tree of prime dmabufs and an IDR (Integer ID Radix tree) mapping integer handles to kernel objects. Commit 5e28b7b94408 introduced a logic error in the 'change handle' code path: when generating a new IDR entry to replace an existing handle's pointer, the replacement write was made at the wrong location, leaving the old IDR entry referencing a stale or orphaned object. When the DRM file is closed, drm_file_free invokes drm_prime_destroy_file_private, which asserts the dmabufs red-black tree is empty (!RB_EMPTY_ROOT); the orphaned entry violates this invariant and triggers a kernel WARNING. No CWE is formally assigned, but the root cause matches a handle/pointer management logic error (analogous to CWE-672 or CWE-476 variants). CPE data identifies the affected product as cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*.