CVE-2026-23149
Integer Overflow in Linux DRM GEM Handle Allows Kernel Warnings
Publication date: 2026-02-14
Last updated on: 2026-03-17
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | From 6.18 (inc) to 6.18.9 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's Direct Rendering Manager (DRM) subsystem, specifically in the drm_gem_change_handle_ioctl() function. The issue arises because GEM buffer object handles are represented as 32-bit unsigned integers (u32) in the user API, but internally the kernel uses idr_alloc() which operates within signed integer (int) ranges.
If a user passes a new handle value larger than INT_MAX (the maximum value for a signed int), it triggers a kernel warning due to the internal idr_alloc() function checking for negative values and issuing a warning when the start value is less than zero.
The fix involves rejecting any new handles above INT_MAX and adjusting the internal calculations to stay within the int domain, preventing these kernel warnings from being triggered by userspace.
How can this vulnerability impact me? :
This vulnerability can cause kernel warnings to be triggered by userspace applications when they pass handle values larger than INT_MAX. While the description does not explicitly mention crashes or privilege escalation, kernel warnings can indicate instability or unexpected behavior in the kernel.
Such warnings may lead to degraded system reliability or potential denial of service if the kernel reacts adversely to these warnings. It could also complicate debugging and system monitoring due to unexpected kernel messages.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
I don't know