CVE-2026-89823 (GCVE-0-2026-89823)

Vulnerability from cvelistv5 – Published: 2026-09-16 10:30 – Updated: 2026-09-16 14:39
VLAI
Title
drm: fix race between partial drm_dev_register() failure and ioctl
Summary
In the Linux kernel, the following vulnerability has been resolved: drm: fix race between partial drm_dev_register() failure and ioctl If drm_dev_register() fails after registering a minor (e.g. render minor registered, primary minor fails), userspace could have opened the first minor and entered a drm_dev_enter() critical section. Since the unplugged flag was never set, the ioctl proceeds while the error path tears down device resources. Fix this by introducing drm_dev_synchronize_unplug(), which sets the unplugged flag and waits for the SRCU barrier, ensuring all in-flight drm_dev_enter() critical sections complete before cleanup proceeds; call it on the error path of drm_dev_register().
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: bee330f3d67273a68dcb99f59480d59553c008b2 , < 26d9162213952927cd59c0d94b7e0e992b347bec (git)
Affected: bee330f3d67273a68dcb99f59480d59553c008b2 , < 24d28d15c0f7f7d4a1c229f8730314f0f8758810 (git)
Affected: bee330f3d67273a68dcb99f59480d59553c008b2 , < 6729990df9e70623bf53f855b521ae71ca9cb278 (git)
Affected: bee330f3d67273a68dcb99f59480d59553c008b2 , < a0a7e2e177f2f18b9e7318a4c64ac44efd9ef22c (git)
Affected: bee330f3d67273a68dcb99f59480d59553c008b2 , < 19dbfe4d586aecfed121cb3fa62281761d9d341f (git)
Affected: bee330f3d67273a68dcb99f59480d59553c008b2 , < 79d09cfe90304ff4f195e47d569800f5e0f8b854 (git)
Affected: bee330f3d67273a68dcb99f59480d59553c008b2 , < 2d1215a72159d00001e08dee162e27718934bee9 (git)
Affected: bee330f3d67273a68dcb99f59480d59553c008b2 , < eb197f7d60f00d0f5b1b3505dfc86a7e36045a3e (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.18
Unaffected: 0 , < 4.18 (semver)
Unaffected: 5.10.270 , ≤ 5.10.* (semver)
Unaffected: 5.15.221 , ≤ 5.15.* (semver)
Unaffected: 6.1.188 , ≤ 6.1.* (semver)
Unaffected: 6.6.157 , ≤ 6.6.* (semver)
Unaffected: 6.12.110 , ≤ 6.12.* (semver)
Unaffected: 6.18.51 , ≤ 6.18.* (semver)
Unaffected: 7.2.5 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/drm_drv.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "26d9162213952927cd59c0d94b7e0e992b347bec",
              "status": "affected",
              "version": "bee330f3d67273a68dcb99f59480d59553c008b2",
              "versionType": "git"
            },
            {
              "lessThan": "24d28d15c0f7f7d4a1c229f8730314f0f8758810",
              "status": "affected",
              "version": "bee330f3d67273a68dcb99f59480d59553c008b2",
              "versionType": "git"
            },
            {
              "lessThan": "6729990df9e70623bf53f855b521ae71ca9cb278",
              "status": "affected",
              "version": "bee330f3d67273a68dcb99f59480d59553c008b2",
              "versionType": "git"
            },
            {
              "lessThan": "a0a7e2e177f2f18b9e7318a4c64ac44efd9ef22c",
              "status": "affected",
              "version": "bee330f3d67273a68dcb99f59480d59553c008b2",
              "versionType": "git"
            },
            {
              "lessThan": "19dbfe4d586aecfed121cb3fa62281761d9d341f",
              "status": "affected",
              "version": "bee330f3d67273a68dcb99f59480d59553c008b2",
              "versionType": "git"
            },
            {
              "lessThan": "79d09cfe90304ff4f195e47d569800f5e0f8b854",
              "status": "affected",
              "version": "bee330f3d67273a68dcb99f59480d59553c008b2",
              "versionType": "git"
            },
            {
              "lessThan": "2d1215a72159d00001e08dee162e27718934bee9",
              "status": "affected",
              "version": "bee330f3d67273a68dcb99f59480d59553c008b2",
              "versionType": "git"
            },
            {
              "lessThan": "eb197f7d60f00d0f5b1b3505dfc86a7e36045a3e",
              "status": "affected",
              "version": "bee330f3d67273a68dcb99f59480d59553c008b2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/drm_drv.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.18"
            },
            {
              "lessThan": "4.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.270",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.51",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.270",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.221",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.188",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.110",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.51",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.5",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm: fix race between partial drm_dev_register() failure and ioctl\n\nIf drm_dev_register() fails after registering a minor (e.g. render minor\nregistered, primary minor fails), userspace could have opened the first\nminor and entered a drm_dev_enter() critical section. Since the\nunplugged flag was never set, the ioctl proceeds while the error path\ntears down device resources.\n\nFix this by introducing drm_dev_synchronize_unplug(), which sets the\nunplugged flag and waits for the SRCU barrier, ensuring all in-flight\ndrm_dev_enter() critical sections complete before cleanup proceeds; call\nit on the error path of drm_dev_register()."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The race is entered by opening a newly published DRM minor (/dev/dri/renderD* or card*) and issuing ioctl/mmap into drm_dev_enter(); that is a local char-dev syscall path, not network, adjacent-radio, or USB packet processing.\nAC:L - The attacker controls the userspace side (inotify on the new node, open, concurrent DRM_RENDER_ALLOW ioctl/mmap) and can force later drm_dev_register() steps to fail after the first minor is live (ENOMEM in create_compat_control_link or drm_modeset_register_all). Modern drivers skip drm_global_mutex, so open is not serialized with register.\nPR:L - The commit\u0027s example publishes the render minor first; that node has no CAP_SYS_ADMIN check, and the overlapping ioctls are DRM_RENDER_ALLOW. Unprivileged local users on phones, desktops, and GPU VMs routinely open /dev/dri/renderD*.\nUI:N - The attacker opens their own DRM fd and issues ioctls; GPU or hotplug display probe runs in kernel driver init and does not require a victim to mount media or open a file.\nS:U - The use-after-free is of host-kernel DRM/driver resources that drm_dev_enter() is meant to protect, remaining in the same kernel authority; this is not a VM escape or IOMMU/DMA bypass.\nC:H - On drm_dev_register() error, probe rollback frees devm MMIO and driver objects while an in-flight drm_dev_enter() ioctl/mmap still uses them, a use-after-free that enables kernel memory disclosure.\nI:H - The same use-after-free of driver state during concurrent ioctl/mmap allows heap spraying, arbitrary writes, and control-flow hijack, matching kernel guidance that UAF is Integrity High.\nA:H - Racing ioctl/mmap against probe teardown oopses or panics via stale mappings or freed objects; a use-after-free also crashes when not fully exploited."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-16T14:39:02.220Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/26d9162213952927cd59c0d94b7e0e992b347bec"
        },
        {
          "url": "https://git.kernel.org/stable/c/24d28d15c0f7f7d4a1c229f8730314f0f8758810"
        },
        {
          "url": "https://git.kernel.org/stable/c/6729990df9e70623bf53f855b521ae71ca9cb278"
        },
        {
          "url": "https://git.kernel.org/stable/c/a0a7e2e177f2f18b9e7318a4c64ac44efd9ef22c"
        },
        {
          "url": "https://git.kernel.org/stable/c/19dbfe4d586aecfed121cb3fa62281761d9d341f"
        },
        {
          "url": "https://git.kernel.org/stable/c/79d09cfe90304ff4f195e47d569800f5e0f8b854"
        },
        {
          "url": "https://git.kernel.org/stable/c/2d1215a72159d00001e08dee162e27718934bee9"
        },
        {
          "url": "https://git.kernel.org/stable/c/eb197f7d60f00d0f5b1b3505dfc86a7e36045a3e"
        }
      ],
      "title": "drm: fix race between partial drm_dev_register() failure and ioctl",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89823",
    "datePublished": "2026-09-16T10:30:55.534Z",
    "dateReserved": "2026-09-11T19:38:34.768Z",
    "dateUpdated": "2026-09-16T14:39:02.220Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-89823",
      "date": "2026-09-25",
      "epss": "0.00176",
      "percentile": "0.06331"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-24T01:57:18.000Z",
      "cve": "CVE-2026-89823",
      "id": "msrc_CVE-2026-89823",
      "initial_release_date": "2026-09-17T01:10:42.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "drm: fix race between partial drm_dev_register() failure and ioctl",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-89823.json",
      "version": "4"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/gpu/drm/drm_drv.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "26d9162213952927cd59c0d94b7e0e992b347bec",
                    "status": "affected",
                    "version": "bee330f3d67273a68dcb99f59480d59553c008b2",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "24d28d15c0f7f7d4a1c229f8730314f0f8758810",
                    "status": "affected",
                    "version": "bee330f3d67273a68dcb99f59480d59553c008b2",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6729990df9e70623bf53f855b521ae71ca9cb278",
                    "status": "affected",
                    "version": "bee330f3d67273a68dcb99f59480d59553c008b2",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "a0a7e2e177f2f18b9e7318a4c64ac44efd9ef22c",
                    "status": "affected",
                    "version": "bee330f3d67273a68dcb99f59480d59553c008b2",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "19dbfe4d586aecfed121cb3fa62281761d9d341f",
                    "status": "affected",
                    "version": "bee330f3d67273a68dcb99f59480d59553c008b2",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "79d09cfe90304ff4f195e47d569800f5e0f8b854",
                    "status": "affected",
                    "version": "bee330f3d67273a68dcb99f59480d59553c008b2",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "2d1215a72159d00001e08dee162e27718934bee9",
                    "status": "affected",
                    "version": "bee330f3d67273a68dcb99f59480d59553c008b2",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "eb197f7d60f00d0f5b1b3505dfc86a7e36045a3e",
                    "status": "affected",
                    "version": "bee330f3d67273a68dcb99f59480d59553c008b2",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/gpu/drm/drm_drv.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "4.18"
                  },
                  {
                    "lessThan": "4.18",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.270",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.221",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.188",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.157",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.110",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.51",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.5",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3-rc1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm: fix race between partial drm_dev_register() failure and ioctl\n\nIf drm_dev_register() fails after registering a minor (e.g. render minor\nregistered, primary minor fails), userspace could have opened the first\nminor and entered a drm_dev_enter() critical section. Since the\nunplugged flag was never set, the ioctl proceeds while the error path\ntears down device resources.\n\nFix this by introducing drm_dev_synchronize_unplug(), which sets the\nunplugged flag and waits for the SRCU barrier, ensuring all in-flight\ndrm_dev_enter() critical sections complete before cleanup proceeds; call\nit on the error path of drm_dev_register()."
          }
        ],
        "id": "CVE-2026-89823",
        "lastModified": "2026-09-16T15:18:11.300",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-16T11:16:48.850",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/19dbfe4d586aecfed121cb3fa62281761d9d341f"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/24d28d15c0f7f7d4a1c229f8730314f0f8758810"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/26d9162213952927cd59c0d94b7e0e992b347bec"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/2d1215a72159d00001e08dee162e27718934bee9"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/6729990df9e70623bf53f855b521ae71ca9cb278"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/79d09cfe90304ff4f195e47d569800f5e0f8b854"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/a0a7e2e177f2f18b9e7318a4c64ac44efd9ef22c"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/eb197f7d60f00d0f5b1b3505dfc86a7e36045a3e"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.