CVE-2026-52966: Linux DRM IDR Pointer Logic Error – Local DoS Vulnerability

Technical summary

CVE-2026-52966 involves a pointer assignment logic error introduced in commit 5e28b7b94408 within the DRM prime buffer handling code (drivers/gpu/drm/drm_prime.c). The vulnerability occurs in the IDR (ID Radix-tree) pointer replacement logic during the change handle flow. When a new IDR object is allocated, the original pointer is not correctly replaced, resulting in dangling references within the dmabuf tree structure. This causes the RB_EMPTY_ROOT check in drm_prime_destroy_file_private to fail with a kernel warning, and can lead to memory corruption or denial of service during file descriptor cleanup.

Business impact

This vulnerability enables a local denial of service attack against systems running affected Linux kernels. A logged-in user or local process with access to DRM device files (/dev/dri/*) can trigger a kernel warning or crash by opening and closing graphics device files abnormally, disrupting GPU services and potentially the entire graphical environment. The attack requires local access and does not grant privilege escalation or data exfiltration, limiting impact to availability.

Affected systems

The Linux kernel is affected across all architectures and distributions that include DRM support. Systems most vulnerable are those where unprivileged users can access DRM device files, including multi-user desktop and server environments, containerized systems where users have device access, and systems running kernel versions after commit 5e28b7b94408 up to the point where this fix is integrated. Verify the exact affected kernel versions against the Linux kernel security advisories and your distribution's patch timeline.

Exploitability

Exploitability is limited to local attackers with DRM device file access. No authentication bypass, network vector, or privilege escalation is involved. The attack is straightforward—opening and closing a graphics device file under specific conditions triggers the kernel warning. The CVSS vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) reflects local access requirement, low complexity, and availability impact only. This is not a widely exploitable remote vulnerability, but poses real risk in shared systems.

Remediation

Apply a Linux kernel update that includes the fix for CVE-2026-52966. The resolution involves correctly replacing the IDR pointer during the change handle logic and removing an unnecessary conditional check in the exit path. Verify with your Linux distribution or kernel vendor for specific patch version numbers and availability. Interim mitigations include restricting DRM device file access to trusted users via file permissions (chmod 600 /dev/dri/*) or leveraging SELinux/AppArmor policies to limit which processes can interact with DRM devices.

Patch guidance

Monitor your Linux distribution's security advisories for kernel updates addressing this CVE. When available, apply kernel security updates through your standard patch management process (apt, yum, zypper, etc.). Test updates in a non-production environment first, particularly for graphics-dependent workloads. The fix is relatively low-risk as it corrects a pointer assignment and removes unnecessary error handling, reducing the likelihood of regression. Kernel reboot is required; plan downtime accordingly for critical systems.

Detection guidance

Look for kernel warnings in system logs containing 'RB_EMPTY_ROOT' or references to drm_prime_destroy_file_private at drivers/gpu/drm/drm_prime.c:224. Monitor dmesg or journalctl for CPU-specific warning messages tied to DRM file cleanup. Correlate these warnings with process activity on /dev/dri/* devices to identify which user or service triggered them. Intrusion detection systems may flag repeated rapid open/close cycles on DRM device files. Note that the presence of warnings does not guarantee active exploitation, but indicates either the vulnerability is present or environmental stress on DRM subsystem.

Why prioritize this

Despite a MEDIUM CVSS score, this vulnerability merits prompt attention in most environments due to its local denial of service capability and the DRM subsystem's role in graphics infrastructure. Prioritize patching on: (1) multi-user systems and shared desktops where untrusted users can access DRM devices; (2) container platforms running graphics workloads where user-namespace isolation may not fully prevent DRM device access; (3) headless servers with GPU acceleration if unprivileged services interact with DRM. Lower priority on single-user systems or those with strict DRM device access controls. Not included in CISA KEV catalog at this time, but monitor for changes if weaponization emerges.

Risk score, explained

The CVSS 3.1 score of 5.5 (MEDIUM) appropriately captures the limited attack surface (local access only, PR:L) and availability impact (A:H). No confidentiality or integrity impact is possible. The score does not inflate for broad reachability because many systems restrict DRM device access. However, in permissive environments or container runtimes, the real-world risk may be higher than the base score suggests. Organizations should adjust risk rating based on their specific DRM device access policies and multi-user deployment patterns.

Frequently asked questions