Linux kernel (drivers/gpu/drm): DRM core stores a pointer to the caller's struct pid before taking a reference on it

Impact

DRM core stores a pointer to the caller's struct pid before taking a reference on it, so two processes issuing ioctls on the same DRM fd can drive that pid to refcount zero while it is still referenced. This is a use-after-free of a core kernel object reachable from any GPU node, on any driver - a strong local privilege-escalation primitive out of a tenant container.

Who can reach it

Any tenant holding any /dev/dri node (renderD* is enough - the path is in drm_file, not a driver). Share the fd across two processes via fork() or SCM_RIGHTS and have both issue DRM ioctls in a loop. Requires CONFIG_PREEMPT_RCU, which is common on distro kernels. Driver-independent: amdgpu, xe, i915, nouveau, virtio-gpu are all exposed.

What to do

Update to 6.6.37 or later (or the equivalent fix in your stable series). No workable interim control other than removing /dev/dri from tenant containers - this is core DRM, hit by every ioctl.

References