CVE-2026-89823: drm: fix race between partial drm_dev_register() failure and ioctl
drm: fix race between partial drmdevregister() failure and ioctl
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.157.1-1
Event History
Frequently Asked Questions
Who can trigger the race condition?
A local userspace process that can open a DRM device minor can trigger it if drm_dev_register() partially succeeds, leaving one minor registered before registration of another minor fails. The process must then enter an ioctl path while the kernel is handling the registration failure.
Are systems affected during normal successful DRM device registration?
The described race is tied specifically to a partial drm_dev_register() failure after at least one DRM minor has already been registered. The data does not indicate that fully successful device registration alone triggers the issue.
What is the impact of the fix?
The fix marks the device as unplugged and waits for in-flight drm_dev_enter() critical sections to finish before device resources are cleaned up. This prevents an ioctl from continuing to use resources while the failed-registration cleanup path tears them down.