CVE-2026-23149

drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl()

published February 14, 2026

CVSS
—
EPSS
0%
Percentile
1.6
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl()

Since GEM bo handles are u32 in the uapi and the internal implementation

uses idr_alloc() which uses int ranges, passing a new handle larger than

INT_MAX trivially triggers a kernel warning:

idr_alloc():

...

if (WARN_ON_ONCE(start < 0))

return -EINVAL;

...

Fix it by rejecting new handles above INT_MAX and at the same time make

the end limit calculation more obvious by moving into int domain.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00118 · 1.6th percentile
Published
2026-02-14T16:01Z
EPSS history
Timeline
  • 14 FEB 16:01Z
    drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl()
    cvelistv5