HIGH Introduced in 4.18
drm DevRegister Race
CVE-2026-89823
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI6.8MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: drm: fix race between partial drm_dev_register() failure and ioctl If drm_dev_register() fails after registering a minor (e.g. render minor registered, primary minor fails), userspace could have opened the first minor and entered a drm_dev_enter() critical section. Since the unplugged flag was never set, the ioctl proceeds while the error path tears down device resources. Fix this by introducing drm_dev_synchronize_unplug(), which sets the unplugged flag and waits for the SRCU barrier, ensuring all in-flight drm_dev_enter() critical sections complete before cleanup proceeds; call it on the error path of drm_dev_register().
02KernelScan AI Analysis
Risk summary
A local user who can open a DRM render node can exploit a race condition during partial device registration failure to access device resources while they are being torn down, resulting in a use-after-free. This can lead to kernel memory corruption, privilege escalation, or a system crash. The race is most reliably triggered by hotplugging a malicious USB GPU that causes registration to fail partway through.
Vulnerability analysis
When a DRM device's registration fails after one device node has already been created (for example, the render node succeeds but the primary node fails), the error cleanup path tears down device resources without first marking the device as unplugged or waiting for any in-flight operations to finish. A local user who opened the already-registered device node during this brief window can have an ioctl in progress that accesses device memory while the cleanup path frees it, leading to a use-after-free. The fix introduces a synchronization step on the registration error path that marks the device as unplugged and waits for all in-flight critical sections to complete before any cleanup begins. This race is reachable by any local user who can open a DRM render node, and the registration failure can be triggered by hotplugging a malicious USB GPU device or by a driver encountering an error during initialization.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 5.10 | 4.18 | 5.10.270 | 26d916221395 |
| 5.15 | 4.18 | 5.15.221 | 24d28d15c0f7 |
| 6.1 | 4.18 | 6.1.188 | 6729990df9e7 |
| 6.6 | 4.18 | 6.6.157 | a0a7e2e177f2 |
| 6.12 | 4.18 | 6.12.110 | 19dbfe4d586a |
| 6.18 | 4.18 | 6.18.51 | 79d09cfe9030 |
| 7.2 | 4.18 | 7.2.5 | 2d1215a72159 |
| mainline | 4.18 | 7.3-rc1 | eb197f7d60f0 |
| cip/6.12 | 4.18 | 6.12.111-cip32 | 19dbfe4d586a |