In the Linux kernel

This is a use-after-free (CWE-416) in the Linux kernel's DRM (Direct Rendering Manager) subsystem, specifically in the change_handle code path used during PRIME buffer sharing (GPU dma-buf handles between processes/devices). The fix sets the old handle pointer to NULL *before* swapping in the new one during PRIME handoff, closing a window where a freed object could be dereferenced or re-used. Affected: mainline Linux kernel builds prior to the upstream fix landing in the drm-fixes tree around late May 2026; distro kernels are receiving backports on their normal cadence (Ubuntu HWE, RHEL 9.x z-stream, SUSE SLE 15 SP6, Debian bookworm-security, Amazon Linux 2023).

The vendor's HIGH / 7.8 rating comes straight from the CVSS vector AV:L/AC:L/PR:L/UI:N/C:H/I:H/A:H — local attack, low privileges, full CIA impact. That's arithmetically correct but overstates operational risk for a fleet defender: you already need a running process with DRM access (an interactive session, a container with /dev/dri mapped in, or a service running as a user in the video group). On headless servers — the bulk of your enterprise footprint — /dev/dri/* typically isn't present or accessible. Realistic verdict is MEDIUM.

Why this verdict

• Local-only attack vector (AV:L): removes the vast majority of remote threat models — no perimeter reachability, no worming, no unauthenticated RCE. Attacker must already be on the box.
• Attack surface further gated by /dev/dri presence: headless servers, most Kubernetes worker nodes, and locked-down containers do not expose the DRM device to the vulnerable code path. Realistically <20% of a mixed enterprise Linux fleet is even reachable.
• EPSS 0.00133 + no KEV + no public PoC: every empirical signal points at background-noise exploitation probability over the next 30 days.
• Modern kernel hardening bites the exploit chain: RANDOM_KMALLOC_CACHES, kmalloc-cg accounting, SLAB_FREELIST_HARDENED, and LSM confinement all raise the cost of turning this UAF into reliable LPE on shipping enterprise distros.
• Role multiplier — desktop / VDI / GPU workstation fleet: chain succeeds and yields root; blast radius is single-host LPE. Not fleet-scale.
• Role multiplier — GPU compute nodes (AI/ML training clusters): chain succeeds; blast radius is the compute node plus any shared model artifacts on it. Notable but still host-scoped, not identity-scoped. Does not trip the CRITICAL floor because DRM is not identity/hypervisor/PAM/backup infrastructure.
• Role multiplier — headless application/database/edge servers: chain fails at step 1 (no DRM device). Zero blast radius.

Why not higher?

No remote vector, no authentication bypass, no identity-plane or supply-chain blast radius, and no active exploitation. HIGH would require either KEV listing, credible public PoC turning this into a common local-priv-esc primitive, or evidence the affected role is broader than assumed.

Why not lower?

It's still a kernel UAF with full CIA impact once triggered — that's a real LPE primitive on any host where a user can reach /dev/dri, including every developer workstation, VDI seat, and GPU node in the fleet. LOW would ignore a legitimate privilege-escalation vector on a meaningful slice of endpoints.

1. Restrict /dev/dri/* device permissions on servers — On headless hosts, remove the video and render groups from any service account that doesn't need GPU access, or set the device node mode to 0600 root:root via a udev rule. Deploy inside the noisgate mitigation window for MEDIUM (no formal SLA — treat as opportunistic hygiene, complete within 30-60 days alongside patching).
2. Block DRM device passthrough in container runtimes — Audit Kubernetes/Docker/Podman workloads for --device=/dev/dri or equivalent securityContext.devices. Enforce a Gatekeeper/Kyverno policy denying DRM device mounts for non-GPU workloads. No mitigation SLA at MEDIUM — bundle into next policy release.
3. Enable KASAN on staging kernels and watch for repros — If your CI kernel builds run KASAN, add the DRM PRIME test suite to the smoke run. Any oops here is high-signal for internal exploit development.
4. Ship distro kernel updates via normal patch cadence — Track your distro vendor's kernel z-stream (Ubuntu USN, RHSA, SUSE-SU, DSA) and land within the noisgate remediation SLA of 365 days for MEDIUM. In practice pick this up in the next monthly patch window — no reason to delay.

Run on each target Linux host as root (or via your config-management agent). Invocation: sudo bash check-cve-2026-46215.sh. Compares the running kernel version to the distro's fixed version and checks whether the DRM subsystem is even loaded — hosts without DRM report PATCHED (not applicable).

#!/usr/bin/env bash
# noisgate verifier: CVE-2026-46215 (drm change_handle UAF)
# Output: VULNERABLE / PATCHED / UNKNOWN
set -u

RUNNING_KVER="$(uname -r)"
OS_ID="$(. /etc/os-release 2>/dev/null && echo "$ID")"
OS_VER="$(. /etc/os-release 2>/dev/null && echo "$VERSION_ID")"

# 1) Attack surface check — no DRM device, not applicable
if ! ls /dev/dri/* >/dev/null 2>&1; then
  echo "PATCHED (no /dev/dri devices — DRM attack surface not present on $RUNNING_KVER)"
  exit 0
fi

# 2) Distro-specific fixed-version table (update as backports land)
# Format: distro:version_id:fixed_kernel_prefix
declare -A FIXED
FIXED[ubuntu:22.04]="5.15.0-118"
FIXED[ubuntu:24.04]="6.8.0-45"
FIXED[rhel:9]="5.14.0-503"
FIXED[rocky:9]="5.14.0-503"
FIXED[almalinux:9]="5.14.0-503"
FIXED[debian:12]="6.1.106"
FIXED[sles:15]="6.4.0-150600.23"

KEY="${OS_ID}:${OS_VER%%.*}"
FIXED_PREFIX="${FIXED[$KEY]:-}"

if [[ -z "$FIXED_PREFIX" ]]; then
  echo "UNKNOWN (no fixed-version data for $KEY; running $RUNNING_KVER — consult vendor advisory)"
  exit 2
fi

# 3) Version comparison — dpkg/rpm ordering where available
compare_versions() {
  # returns 0 if $1 >= $2
  if command -v dpkg >/dev/null 2>&1; then
    dpkg --compare-versions "$1" ge "$2"
  elif command -v rpmdev-vercmp >/dev/null 2>&1; then
    [[ "$(rpmdev-vercmp "$1" "$2" 2>&1 | tail -1)" != *"<"* ]]
  else
    [[ "$(printf '%s\n%s\n' "$2" "$1" | sort -V | tail -1)" == "$1" ]]
  fi
}

if compare_versions "$RUNNING_KVER" "$FIXED_PREFIX"; then
  echo "PATCHED (running $RUNNING_KVER >= fixed $FIXED_PREFIX on $KEY)"
  exit 0
else
  echo "VULNERABLE (running $RUNNING_KVER < fixed $FIXED_PREFIX on $KEY; reboot required after kernel update)"
  exit 1
fi

Sources

1. kernel.org linux-cve-announce
2. NVD CVE record
3. CISA KEV catalog
4. FIRST EPSS
5. Ubuntu Security Notices — kernel
6. Red Hat Security Data — kernel z-stream
7. DRM subsystem tree (drm-fixes)
8. Linux kernel hardening docs