Linux kernel DRM core: race between failed drm_dev_register() and an open ioctl frees device state in use

Impact

If drm_dev_register() fails part way through - render minor registered, primary minor fails - userspace can already have opened the registered minor and entered a drm_dev_enter() critical section. The unplugged flag was never set, so the ioctl keeps running while the error path tears the device down, giving a use-after-free on DRM device state. This is core DRM code shared by every accelerator driver that registers through it, including amdgpu, so it applies to GPU nodes generally rather than one vendor. The window is narrow and only opens on a failed driver probe, which in practice means a node that is already misbehaving during boot or a driver reload - but a tenant process racing a reprobe on a shared node can turn that into kernel memory corruption. The fix adds drm_dev_synchronize_unplug() to set the flag and drain in-flight readers before cleanup.

Who can reach it

Local user able to open a DRM device node, racing a driver registration that fails - typically during module load or reload. No authentication beyond device access; no remote path.

What to do

Take the stable kernel carrying the drm_dev_synchronize_unplug() fix (five stable commits referenced) and reboot each node; on GPU hosts that means draining jobs first. No fixed release number is given in the record. Nothing to mitigate at runtime other than not reloading GPU driver modules while tenant workloads hold DRM handles.

References

Related entries

• Linux kernel drm/xe: flat CCS storage published as usable VRAM, corrupting allocationsCVE-2026-90047 · Linux kernel drm/xe (flat CCS offset rounding)High
• Linux kernel amdgpu: off-by-one in MST HDCP per-connector arrays sized 31 instead of 32CVE-2026-90289 · Linux kernel amdgpu display (AMDGPU_DM_MAX_DISPLAY_COUNT, MST HDCP per-connector arrays)High
• Linux kernel amdgpu DM: CRTC reset leaves a dangling state pointer when allocation failsCVE-2026-93175 · Linux kernel amdgpu display (amdgpu_dm_crtc_reset_state)High
• Linux amdkfd: use-after-free race when two threads destroy the same compute queueCVE-2026-97429 · Linux kernel amdkfd (destroy_queue_cpsch)High
• Linux amdkfd: missing bounds check on the CRIU-supplied SDMA queue idCVE-2026-97497 · Linux kernel amdkfd (allocate_sdma_queue restore_sdma_id bounds check)High
• Linux drm/virtio: virtio-gpu hands guest-physical addresses to the host on Xen PV, exposing another domain's memoryCVE-2026-98156 · Linux kernel drm/virtio (virtio-gpu resource backing, DMA API on Xen PV)High