CVE-2026-46215: Linux Kernel DRM GEM_CHANGE_HANDLE Use-After-Free Local Root Privilege Escalation
CVE-2026-46215 (TL-2026-1504) is a high-severity software vulnerability scored CVSS 7.8, first published 2026-07-18. It has no confirmed attribution, affects Linux Kernel Linux Kernel (DRM/GEM subsystem), references 1 CVE (CVE-2026-46215), maps to 13 MITRE ATT&CK techniques (T1059, T1068, T1069), and is covered by 9 detection rules and 30 indicators of compromise.
Key facts for TL-2026-1504
- Threat ID
- TL-2026-1504
- Severity
- HIGH
- CVSS
- 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- 2026-07-18
- Last reviewed
- 2026-07-18
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- technology, government administration, critical-infrastructure, cloud-hosting, education, finance
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 30
Malware and tooling in CVE-2026-46215
Malware and tooling: CVE-2026-46215-EXPLOIT, CVE-2026-46215-POC
A race condition in the Linux kernel DRM subsystem's DRM_IOCTL_GEM_CHANGE_HANDLE ioctl allows any local user with access to a GPU render node (/dev/dri/renderD* or /dev/dri/card*) to trigger a use-after-free and escalate to root with a reported ~99% success rate. Public proof-of-concept exploit code chaining heap grooming, KASLR bypass, and a DirtyPipe-mitigation bypass to overwrite /etc/passwd is publicly available, affecting Linux kernel 6.18 through 6.18.31 and 6.19 through 7.0.8 across Debian, Red Hat, SUSE, and Ubuntu.
How CVE-2026-46215 works
CVE-2026-46215 is a use-after-free (CWE-416) rooted in a time-of-check/time-of-use race condition (CWE-362) inside the Linux kernel Direct Rendering Manager (DRM) GEM (Graphics Execution Manager) core, specifically the DRM_IOCTL_GEM_CHANGE_HANDLE ioctl introduced in kernel v6.18-rc1 to support AMD's CRIU (Checkpoint/Restore In Userspace) infrastructure. The ioctl migrates a GEM buffer object from one IDR (ID Radix tree) handle to another by directly manipulating the object's IDR entries rather than using the kernel's existing handle-lifecycle helpers, and critically never adjusts the object's handle_count. This creates a brief window in which a single GEM object holds two live IDR entries while handle_count still reads 1. A second thread that concurrently issues DRM_IOCTL_GEM_CLOSE against the old handle drives handle_count to 0, freeing the underlying object while the new IDR entry still references the now-freed memory. Because both DRM_IOCTL_GEM_CHANGE_HANDLE and DRM_IOCTL_GEM_CLOSE carry the DRM_RENDER_ALLOW flag, any unprivileged process able to open /dev/dri/renderD* (i.e., any member of the 'video' group, which is standard on most desktop and many server Linux configurations using systemd-logind) can reach the race with no special privileges.
Public proof-of-concept exploit code (0xCyberstan/CVE-2026-46215-POC and bluedragonsecurity/CVE-2026-46215-EXPLOIT) demonstrates a full five-stage exploitation chain: (1) win the DRM_IOCTL_GEM_CHANGE_HANDLE vs DRM_IOCTL_GEM_CLOSE race to produce a dangling handle referencing freed kernel memory; (2) spray pipe_buffer structures via slab conditioning to reclaim the freed object with attacker-controlled data; (3) leak a kernel pointer through the dangling handle to defeat KASLR; (4) abuse handle/FLINK manipulation to set PIPE_BUF_FLAG_CAN_MERGE on a page-cache-backed pipe buffer, bypassing the 2022 DirtyPipe (CVE-2022-0847) mitigation; and (5) use the resulting arbitrary page-cache write primitive to overwrite /etc/passwd, stripping root's password hash and achieving passwordless root. Independent testing across 100 boots reported 99 successful privilege escalations, indicating the exploit is highly reliable rather than opportunistic.
The flaw was reported to security@kernel.org on 2026-04-12 and fixed upstream in late May 2026 via three commits (5e28b7b94408, 61bd96d3e547, 672464dd5323), shipping in 6.18.32, 7.0.9, and 7.1-rc3; the vulnerable DRM_IOCTL_GEM_CHANGE_HANDLE ioctl itself is scheduled for removal in the upcoming 7.1 release. HKCERT (govcert.gov.hk) issued High Threat Security Alert A26-07-19 on 2026-07-10 after public PoC and technical writeups (cyberpress.org, howtouselinux.com) were published on 2026-07-09, flagging the vulnerability as high risk of exploitation due to the availability of working exploit code across Debian, Red Hat, SUSE, and Ubuntu kernel builds that had not yet applied the backported fix.
MITRE ATT&CK techniques used in TL-2026-1504
Execution
T1059 Command and Scripting Interpreter
Privilege Escalation
T1068 Exploitation for Privilege Escalation
Discovery
T1069 Permission Groups Discovery; T1082 System Information Discovery; T1083 File and Directory Discovery
Defense Evasion
T1070 Indicator Removal; T1211 Exploitation for Stealth
Initial Access
Persistence
T1098 Account Manipulation; T1136 Create Account
Impact
T1489 Service Stop; T1499 Endpoint Denial of Service
Resource Development
Affected products and versions in CVE-2026-46215
- Linux Kernel — Linux Kernel (DRM/GEM subsystem)
Vulnerable versions: 6.18-rc1 through 6.18.31; 6.19 through 7.0.8
Fixed in: 6.18.32; 7.0.9; 7.1-rc3 and later - Debian — Debian Linux kernel packages
Vulnerable versions: linux-image builds tracking 6.18-6.18.31 / 7.0-7.0.8
Fixed in: backported security update - Red Hat — Red Hat Enterprise Linux kernel
Vulnerable versions: RHEL kernel builds on affected upstream base
Fixed in: RHSA kernel erratum - SUSE — SUSE Linux Enterprise / openSUSE kernel
Vulnerable versions: SUSE kernel builds on affected upstream base
Fixed in: SUSE security update - Canonical — Ubuntu Linux kernel
Vulnerable versions: Ubuntu kernel builds on affected upstream base
Fixed in: Ubuntu security update (USN)
Remediation for CVE-2026-46215
Patches
- Upstream kernel commit 5e28b7b94408897e41c63477aabc9e1db439bc8c
- Upstream kernel commit 61bd96d3e5472c253f9c1ab77608f0c8aaa9d025
- Upstream kernel commit 672464dd53231509c9c771110798c56d4660e19e
- Vendor kernel packages: Debian, Red Hat (RHSA), SUSE, Ubuntu security updates incorporating the above
Immediate actions
- Apply vendor kernel updates incorporating upstream commits 5e28b7b94408, 61bd96d3e547, and 672464dd5323 (fixed in 6.18.32, 7.0.9, 7.1-rc3+)
- Restrict membership in the 'video' group / udev ACLs controlling /dev/dri/renderD* and /dev/dri/card* to trusted accounts only
- Monitor for kernel oops or KASAN use-after-free reports referencing drm_gem_* or idr_* functions
Workarounds
- Remove untrusted local users from the 'video' group to deny /dev/dri/renderD* access
- Apply restrictive udev rules limiting DRM render-node permissions
- Where feasible, disable or blacklist the affected DRM driver on systems without a business need for GPU render access
Longer-term hardening
- Track kernel CVE advisories from Debian, Red Hat, SUSE, and Ubuntu security trackers for DRM/GEM subsystem fixes
- Deploy KASAN/KFENCE-instrumented kernels in staging to catch DRM use-after-free regressions before production rollout
- Enforce device-node access controls (seccomp, AppArmor/SELinux, cgroup device policies) limiting which local processes may open GPU render nodes
CVEs associated with CVE-2026-46215
CVE-2026-46215
Weaknesses (CWE) in CVE-2026-46215
CWE-416, CWE-362
Timeline of CVE-2026-46215
- Vulnerability independently discovered and reported to security@kernel.org by Puttimet Thammasaeng.
- Linux stable maintainer Greg Kroah-Hartman tags and releases Linux 6.18.32 and 7.0.9, the longterm/stable maintenance kernels incorporating the DRM_IOCTL_GEM_CHANGE_HANDLE handle_count fix alongside unrelated AMDGPU VCN and virtio-vsock corrections.
- Upstream fixes authored by David Francis (AMD) and Dave Airlie, landing as commits 5e28b7b94408, 61bd96d3e547, and 672464dd5323.
- SentinelOne and other vulnerability-intelligence vendors index CVE-2026-46215 following upstream disclosure; NVD record shows initial publication on this date.
- CVE-2026-46215 published in NVD with CVSS 3.1 base score 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and CWE-416 classification.
- Public proof-of-concept exploits (0xCyberstan/CVE-2026-46215-POC and bluedragonsecurity/CVE-2026-46215-EXPLOIT) and technical writeups (cyberpress.org, howtouselinux.com) released, detailing the full heap-spray/KASLR-bypass/DirtyPipe-bypass exploitation chain.
- Ubuntu security tracker lists the flaw against Ubuntu 26.04 LTS 'Resolute' kernel variants (linux, linux-aws, linux-gcp, linux-nvidia, linux-azure-fde) as vulnerable/work-in-progress at Medium priority, while all earlier Ubuntu LTS releases (25.10 back to 14.04) are marked not-affected; the Debian security tracker records the flaw as fixed in unstable/sid (linux 7.1.3-1) with the vulnerable code not present in the older Bullseye, Bookworm, and Trixie kernel bases.
- HKCERT (govcert.gov.hk) publishes High Threat Security Alert A26-07-19 flagging active risk of exploitation across Debian, Red Hat, SUSE, and Ubuntu due to availability of public PoC code; NVD record last-updated the same day.
- Threadlinqs Intelligence Platform completes deep-dive research and detection coverage for CVE-2026-46215.
Sources cited for CVE-2026-46215
- High Threat Security Alert (A26-07-19): Vulnerability in Linux Kernel
- CVE-2026-46215: Linux Kernel Race Condition Vulnerability
- Linux Kernel Flaw (CVE-2026-46215) Gives Any Local User Passwordless Root via GPU Render Nodes
- PoC and Technical Details Released for Linux Kernel Privilege Escalation Vulnerability
- CVE-2026-46215-EXPLOIT (bluedragonsecurity)
- CVE-2026-46215-POC (0xCyberstan)
- CVE-2026-46215 Detail
- CVE-2026-46215 | Ubuntu Security Tracker
- CVE-2026-46215 | Debian Security Tracker
- Linux 7.0.9 and new LTS maintenance releases: Kernel.org delivers a broad stable wave
Threats related to CVE-2026-46215
- RefluXFS: Linux Kernel XFS Copy-on-Write Race Condition Local Privilege Escalation (CVE-2026-64600)
- Linux Kernel FUSE Page-Cache Buffer Overflow (CVE-2026-31694) Enables Local Privilege Escalation
- CVE-2026-53359 ("Januscape") - 16-Year-Old Linux KVM Shadow MMU Use-After-Free Exploited as Zero-Day
- PinTheft — Linux Kernel RDS Zerocopy FOLL_PIN Refcount Imbalance Chained With io_uring Fixed Buffers For Page-Cache Overwrite And Local Root (Public PoC, Arch Linux Default-Affected)
- F5OS / Traffix SDC Information Disclosure (CVE-2026-46333) — Linux Kernel ptrace/pidfd_getfd Race Condition, Public PoC (CHARON)
- DirtyClone (CVE-2026-43503): Linux Kernel Packet-Cloning Page-Cache Write Enables Local Privilege Escalation to Root via IPsec ESP
Detection coverage for TL-2026-1504
As of 2026-07-18, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1504 across Splunk SPL, Microsoft KQL and Sigma, covering 30 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.