Critical Linux Kernel Flaw Allows Root Access via DRM Render Nodes

Key Takeaways

• A critical Linux kernel vulnerability (CVE-2026-46215) allowed local privilege escalation to root.
• The flaw affected mainline kernels from v6.18-rc1 up to fixed versions, impacting users with GPU render node access.
• The bug is a use-after-free condition within the DRM GEM core, specifically in the DRM_IOCTL_GEM_CHANGE_HANDLE ioctl.
• Exploitation was highly reliable, succeeding in 99% of test cases.
• Patches are available in kernel versions 6.18.32, 7.0.9, and 7.1-rc3 onwards. The problematic ioctl is also being disabled in upcoming releases.

A significant vulnerability, identified as CVE-2026-46215, has been discovered and patched in the Linux kernel. This flaw enabled any local user with access to a GPU render node to elevate their privileges to root without requiring special permissions. The vulnerability was present in mainline kernels spanning from v6.18-rc1 until the patch was applied.

The issue was initially reported to [email protected] on April 12, 2026, with a corrective patch implemented in late May 2026.

Technical Details of the Flaw

The core of the vulnerability lies in a use-after-free condition within the DRM GEM (Graphics Execution Manager) core ioctl DRM_IOCTL_GEM_CHANGE_HANDLE. This specific ioctl was introduced in v6.18-rc1 as part of AMD’s development work for CRIU (Checkpoint/Restore in Userspace).

The function of this ioctl is to transfer a graphics buffer object from one handle to another. However, it critically failed to update the object’s handle_count appropriately. This oversight created a brief window where the object possessed two IDR (ID lookup) entries, while its handle count incorrectly remained at 1.

During this vulnerable period, if a second thread invoked DRM_IOCTL_GEM_CLOSE on the original handle, it would decrement the handle count to zero, leading to the premature freeing of the object. Crucially, the new handle would still retain a reference to this now-freed memory, setting up the use-after-free condition.

Both the DRM_IOCTL_GEM_CHANGE_HANDLE and DRM_IOCTL_GEM_CLOSE ioctls are marked with the DRM_RENDER_ALLOW flag. This designation means that any process capable of opening /dev/dri/renderD* can trigger the race condition. On most standard desktop Linux distributions, systemd-logind grants this level of access to any authenticated user by default, broadening the attack surface.

From Race Condition to Root

The Cyberstan proof-of-concept exploit effectively chained multiple sophisticated techniques to leverage the freed object into full root access. The steps involved included:

• Reclaiming the freed memory slot through a technique involving spraying an array of pipe_buffer structures.
• Bypassing KASLR (Kernel Address Space Layout Randomization) by leaking a kernel pointer, achieved through overlapping structure fields.
• Setting the PIPE_BUF_FLAG_CAN_MERGE flag using a clever GEM object naming trick, which circumvents the “DirtyPipe” fix implemented in 2022.
• Overwriting the read-only /etc/passwd file via the page cache, specifically targeting and removing the root user’s password field.

Testing demonstrated the exploit’s high reliability, achieving success in 99 out of 100 test boots. On average, the exploit required fewer than 100 race iterations to win.

While the author of the analysis independently discovered and reported this vulnerability, contributing separate exploit research, researcher Puttimet Thammasaeng was the first to report the same bug and received official CVE credit and upstream “Reported-by” attribution.

The fix, developed by AMD’s David Francis and kernel maintainer Dave Airlie, addresses the race condition by introducing a two-stage idr_replace operation. This mechanism ensures a clean rollback if a concurrent close operation wins the race. Furthermore, kernel maintainers have opted for an even more robust solution: the GEM_CHANGE_HANDLE ioctl will be entirely disabled in the upcoming Linux 7.1 release, completely removing the vulnerable code path. Fixed versions include 6.18.32, 7.0.9, and 7.1-rc3 onwards.

This vulnerability serves as a stark reminder of a recurring pattern in kernel bugs: compound operations on reference-counted objects where references are added, removed, and counted in separate, non-atomic steps. This creates windows during which concurrent teardown processes can free memory that is still actively in use, as the Cyberstan advisory notes. Subsystems that bypass established helper functions for this critical bookkeeping remain susceptible to similar race conditions.

What You Should Do

• Update Your Kernel: Immediately apply available patches by upgrading your Linux kernel to version 6.18.32, 7.0.9, 7.1-rc3, or newer.
• Monitor for Updates: Stay vigilant for official security advisories from your Linux distribution vendor regarding this CVE.
• Restrict Local Access: While this is a local privilege escalation, minimizing local user access to systems can reduce the overall attack surface.
• Review DRM Render Node Permissions: Understand how /dev/dri/renderD* access is managed on your systems and ensure it aligns with your security policies.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.