SecurityLobstersabout 12 hours ago
Unprivileged root via a use-after-free in DRM GEM change_handle (CVE-2026-46215)
1 min read
A use-after-free in the DRM GEM core ioctl DRM_IOCTL_GEM_CHANGE_HANDLE lets any local user with render node access escalate to root. The bug affects Linux v6.18-rc1 through the fix. An exploit chain reclaims the freed slab, leaks a kernel pointer, bypasses the DirtyPipe fix, and overwrites /etc/passwd for passwordless root.
Level
Hype check
Tap to vote and see what everyone thinks.