EUVD-2026-80423
GHSA-hjv8-5wf8-79gw
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local access and a low-priv open of the minor (AV:L/PR:L); AC:H because winning the race depends on an induced, non-attacker-controlled partial registration failure; use-after-free yields full C/I/A impact.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
7DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
drm: fix race between partial drm_dev_register() failure and ioctl
If drm_dev_register() fails after registering a minor (e.g. render minor registered, primary minor fails), userspace could have opened the first minor and entered a drm_dev_enter() critical section. Since the unplugged flag was never set, the ioctl proceeds while the error path tears down device resources.
Fix this by introducing drm_dev_synchronize_unplug(), which sets the unplugged flag and waits for the SRCU barrier, ensuring all in-flight drm_dev_enter() critical sections complete before cleanup proceeds; call it on the error path of drm_dev_register().
AnalysisAI
A race condition in the Linux kernel's Direct Rendering Manager (DRM) core allows a local low-privileged user to trigger use-after-free-style resource teardown by issuing an ioctl on a partially registered DRM device node. When drm_dev_register() fails after one minor (for example the render minor) has already been registered and opened by userspace, the error path tears down device resources without first setting the unplugged flag, so an in-flight drm_dev_enter() critical section can continue operating on freed state. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires local access to the affected DRM device node and the ability to open a DRM minor and issue an ioctl during a very specific window: drm_dev_register() must partially fail - a minor (e.g. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 7.8) rates this a high-severity local flaw with full CIA impact, consistent with a memory-corruption/use-after-free-class race in DRM core. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade to Linux 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.110, 6.18.51, 7.2.5 or later, or to mainline 7.3-rc1, which contain the drm_dev_synchronize_unplug() fix that sets the unplugged flag and waits for the SRCU barrier on the drm_dev_register() error path; downstream distribution kernels should be updated to the corresponding stable-branch revision, since distro kernels inherit the DRM core code and are covered by the generic linux:linux CPE. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Linux hosts, container nodes and virtual desktop images running kernels with DRM render-node support, identify which of them grant non-privileged users or containers access to /dev/dri/* nodes, and prioritize internet-facing or multi-tenant systems that are already behind on kernel maintenance. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today