CVE-2026-23149
MEDIUM
MEDIUM
Priority: 0.01
BB Relevance:
36/100
Published: 2026-02-14
Modified: 2026-11-05
First seen: 2026-11-05
Status: active
Attack Surface
Low Complexity
No Interaction
CVSS Vector Breakdown
AV:
Local
AC:
Low
PR:
Low
UI:
None
S:
Unchanged
C:
None
I:
None
A:
High
Description
In the Linux kernel, the following vulnerability has been resolved: drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() Since GEM bo handles are u32 in the uapi and the internal implementation uses idr_alloc() which uses int ranges, passing a new handle larger than INT_MAX trivially triggers a kernel warning: idr_alloc(): ... if (WARN_ON_ONCE(start < 0)) return -EINVAL; ... Fix it by rejecting new handles above INT_MAX and at the same time make the end limit calculation more obvious by moving into int domain.
Affected Software (11)
| Vendor | Product | Version |
|---|---|---|
| Linux | Linux | 53096728b8910c6916ecc6c46a5abc5c678b58d9 < ae8831ee0fb2f5f41f39722e7b3749d65bb78d08 |
| Linux | Linux | 53096728b8910c6916ecc6c46a5abc5c678b58d9 < 12f15d52d38ac53f7c70ea3d4b3d76afed04e064 |
| Linux | Linux | 6.18 |
| linux | linux_kernel | 6.18 – 6.18.9 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | 6.19 |