Answer in brief
CVE-2026-63885 records a High severity (CVSS 8.8) vulnerability in drm/gem: fix race between change_handle and handle_delete. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 8.8. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Product | Affected versions | Fixed versions |
|---|---|---|
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:linux:linux_kernel:7.1:rc5:*:*:*:*:*:* | Not reported | Not reported |
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=672464dd53231509c9c771110798c56d4660e19e <0dfa42cfe4dbe114533480503934f43e33c1e83d || >=61bd96d3e5472c253f9c1ab77608f0c8aaa9d025 <cde2c9257cbe8463b9dcf7b1075177b72b5fd938 || >=5e28b7b94408897e41c63477aabc9e1db439bc8c <7164d78559b0ff29931a366a840a9e5dd53d4b7c | 0dfa42cfe4dbe114533480503934f43e33c1e83d, cde2c9257cbe8463b9dcf7b1075177b72b5fd938, 7164d78559b0ff29931a366a840a9e5dd53d4b7c |
| Linux/Linuxgeneric | >=6.18.32 <6.18.35 || >=7.0.9 <7.0.12 | 6.18.35, 7.0.12 |
Published upstream
Jul 19, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 26, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 5, 2026
In the Linux kernel, the following vulnerability has been resolved: drm/gem: fix race between change_handle and handle_delete drm_gem_change_handle_ioctl leaves the old handle live in the IDR during the window between spin_unlock(table_lock) and the final spin_lock(table_lock). A concurrent drm_gem_handle_delete on the old handle succeeds in this window, decrements handle_count to 0, and frees the GEM object while the new handle's IDR entry still references it. NULL the old handle's IDR entry before dropping table_lock so that any concurrent GEM_CLOSE on the old handle sees NULL and returns -EINVAL. Restore the old entry on the prime-bookkeeping error path.
Quoted source text, attributed separately from HOL analysis.