CVE-2026-63885

In the Linux kernel, the following vulnerability has been resolved:

drm/gem: fix race between changehandle and handledelete

drmgemchangehandleioctl leaves the old handle live in the IDR during the window between spinunlock(tablelock) and the final spinlock(tablelock). A concurrent drmgemhandledelete on the old handle succeeds in this window, decrements handlecount to 0, and frees the GEM object while the new handle's IDR entry still references it.

NULL the old handle's IDR entry before dropping tablelock so that any concurrent GEMCLOSE on the old handle sees NULL and returns -EINVAL. Restore the old entry on the prime-bookkeeping error path.