# CVE-2026-46215: Linux Kernel DRM GEM_CHANGE_HANDLE Use-After-Free Local Root Privilege Escalation

> A race condition in the Linux kernel DRM subsystem's DRM_IOCTL_GEM_CHANGE_HANDLE ioctl allows any local user with access to a GPU render node (/dev/dri/renderD* or /dev/dri/card*) to trigger a use-after-free and escalate to root with a reported ~99% success rate. Public proof-of-concept exploit code chaining heap grooming, KASLR bypass, and a DirtyPipe-mitigation bypass to overwrite /etc/passwd is publicly available, affecting Linux kernel 6.18 through 6.18.31 and 6.19 through 7.0.8 across Debian, Red Hat, SUSE, and Ubuntu.

- **Published:** 2026-07-18T00:00:00Z
- **Last reviewed:** 2026-07-18T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1504
- **ID:** TL-2026-1504
- **Severity:** HIGH (CVSS 7.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 30 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-46215, CVE-2022-0847

## Description

CVE-2026-46215 is a use-after-free (CWE-416) rooted in a time-of-check/time-of-use race condition (CWE-362) inside the Linux kernel Direct Rendering Manager (DRM) GEM (Graphics Execution Manager) core, specifically the DRM_IOCTL_GEM_CHANGE_HANDLE ioctl introduced in kernel v6.18-rc1 to support AMD's CRIU (Checkpoint/Restore In Userspace) infrastructure. The ioctl migrates a GEM buffer object from one IDR (ID Radix tree) handle to another by directly manipulating the object's IDR entries rather than using the kernel's existing handle-lifecycle helpers, and critically never adjusts the object's handle_count. This creates a brief window in which a single GEM object holds two live IDR entries while handle_count still reads 1. A second thread that concurrently issues DRM_IOCTL_GEM_CLOSE against the old handle drives handle_count to 0, freeing the underlying object while the new IDR entry still references the now-freed memory. Because both DRM_IOCTL_GEM_CHANGE_HANDLE and DRM_IOCTL_GEM_CLOSE carry the DRM_RENDER_ALLOW flag, any unprivileged process able to open /dev/dri/renderD* (i.e., any member of the 'video' group, which is standard on most desktop and many server Linux configurations using systemd-logind) can reach the race with no special privileges.

Public proof-of-concept exploit code (0xCyberstan/CVE-2026-46215-POC and bluedragonsecurity/CVE-2026-46215-EXPLOIT) demonstrates a full five-stage exploitation chain: (1) win the DRM_IOCTL_GEM_CHANGE_HANDLE vs DRM_IOCTL_GEM_CLOSE race to produce a dangling handle referencing freed kernel memory; (2) spray pipe_buffer structures via slab conditioning to reclaim the freed object with attacker-controlled data; (3) leak a kernel pointer through the dangling handle to defeat KASLR; (4) abuse handle/FLINK manipulation to set PIPE_BUF_FLAG_CAN_MERGE on a page-cache-backed pipe buffer, bypassing the 2022 DirtyPipe (CVE-2022-0847) mitigation; and (5) use the resulting arbitrary page-cache write primitive to overwrite /etc/passwd, stripping root's password hash and achieving passwordless root. Independent testing across 100 boots reported 99 successful privilege escalations, indicating the exploit is highly reliable rather than opportunistic.

The flaw was reported to security@kernel.org on 2026-04-12 and fixed upstream in late May 2026 via three commits (5e28b7b94408, 61bd96d3e547, 672464dd5323), shipping in 6.18.32, 7.0.9, and 7.1-rc3; the vulnerable DRM_IOCTL_GEM_CHANGE_HANDLE ioctl itself is scheduled for removal in the upcoming 7.1 release. HKCERT (govcert.gov.hk) issued High Threat Security Alert A26-07-19 on 2026-07-10 after public PoC and technical writeups (cyberpress.org, howtouselinux.com) were published on 2026-07-09, flagging the vulnerability as high risk of exploitation due to the availability of working exploit code across Debian, Red Hat, SUSE, and Ubuntu kernel builds that had not yet applied the backported fix.

## MITRE ATT&CK

- T1588 Obtain Capabilities
- T1078 Valid Accounts
- T1059 Command and Scripting Interpreter
- T1098 Account Manipulation
- T1136 Create Account
- T1068 Exploitation for Privilege Escalation
- T1211 Exploitation for Stealth
- T1070 Indicator Removal
- T1082 System Information Discovery
- T1083 File and Directory Discovery
- T1069 Permission Groups Discovery
- T1489 Service Stop
- T1499 Endpoint Denial of Service

## Sources

- [High Threat Security Alert (A26-07-19): Vulnerability in Linux Kernel](https://www.govcert.gov.hk/en/alerts_detail.php?id=1959)
- [CVE-2026-46215: Linux Kernel Race Condition Vulnerability](https://www.sentinelone.com/vulnerability-database/cve-2026-46215/)
- [Linux Kernel Flaw (CVE-2026-46215) Gives Any Local User Passwordless Root via GPU Render Nodes](https://www.howtouselinux.com/post/linux-kernel-flaw-cve-2026-46215-gives-any-local-user-passwordless-root-via-gpu-render-nodes)
- [PoC and Technical Details Released for Linux Kernel Privilege Escalation Vulnerability](https://cyberpress.org/linux-kernel-privilege-escalation-vulnerability/)
- [CVE-2026-46215-EXPLOIT (bluedragonsecurity)](https://github.com/bluedragonsecurity/CVE-2026-46215-EXPLOIT)
- [CVE-2026-46215-POC (0xCyberstan)](https://github.com/0xCyberstan/CVE-2026-46215-POC)
- [CVE-2026-46215 Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-46215)
- [CVE-2026-46215 | Ubuntu Security Tracker](https://ubuntu.com/security/CVE-2026-46215)
- [CVE-2026-46215 | Debian Security Tracker](https://security-tracker.debian.org/tracker/CVE-2026-46215)
- [Linux 7.0.9 and new LTS maintenance releases: Kernel.org delivers a broad stable wave](https://www.igorslab.de/en/?p=319212)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1504