CVE-2026-89823: drm: fix race between partial drm_dev_register() failure and ioctl
In the Linux kernel, the following vulnerability has been resolved:
drm: fix race between partial drmdevregister() failure and ioctl
If drmdevregister() fails after registering a minor (e.g. render minor registered, primary minor fails), userspace could have opened the first minor and entered a drmdeventer() critical section. Since the unplugged flag was never set, the ioctl proceeds while the error path tears down device resources.
Fix this by introducing drmdevsynchronizeunplug(), which sets the unplugged flag and waits for the SRCU barrier, ensuring all in-flight drmdeventer() critical sections complete before cleanup proceeds; call it on the error path of drmdevregister().
Affected Software
Event History
Frequently Asked Questions
Who can trigger the race condition?
A local userspace process that can open a DRM device minor can trigger it if drm_dev_register() partially succeeds, leaving one minor registered before registration of another minor fails. The process must then enter an ioctl path while the kernel is handling the registration failure.
Are systems affected during normal successful DRM device registration?
The described race is tied specifically to a partial drm_dev_register() failure after at least one DRM minor has already been registered. The data does not indicate that fully successful device registration alone triggers the issue.
What is the impact of the fix?
The fix marks the device as unplugged and waits for in-flight drm_dev_enter() critical sections to finish before device resources are cleaned up. This prevents an ioctl from continuing to use resources while the failed-registration cleanup path tears them down.