CVE-2026-23149
published 2026-02-14CVE-2026-23149: In the Linux kernel, the following vulnerability has been resolved: drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl()…
PriorityP418medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.10%
1.0th percentile
In the Linux kernel, the following vulnerability has been resolved:
drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl()
Since GEM bo handles are u32 in the uapi and the internal implementation
uses idr_alloc() which uses int ranges, passing a new handle larger than
INT_MAX trivially triggers a kernel warning:
idr_alloc():
...
if (WARN_ON_ONCE(start < 0))
return -EINVAL;
...
Fix it by rejecting new handles above INT_MAX and at the same time make
the end limit calculation more obvious by moving into int domain.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.18.9-1 (forky) | linux 6.18.9-1 (forky) |
| linux | linux | — | — |
| linux | linux | >= 53096728b8910c6916ecc6c46a5abc5c678b58d9 < ae8831ee0fb2f5f41f39722e7b3749d65bb78d08 | ae8831ee0fb2f5f41f39722e7b3749d65bb78d08 |
| linux | linux | >= 53096728b8910c6916ecc6c46a5abc5c678b58d9 < 12f15d52d38ac53f7c70ea3d4b3d76afed04e064 | 12f15d52d38ac53f7c70ea3d4b3d76afed04e064 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 6.18.9-1 | 6.18.9-1 |
| linux | linux_kernel | >= 6.18 < 6.18.9 | 6.18.9 |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv5.5MEDIUM
vendor_debian5.5LOW
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-f36v-x2cg-pr97: In the Linux kernel, the following vulnerability has been resolved:
drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_i
ghsa_unreviewed·2026-02-14
CVE-2026-23149 [MEDIUM] GHSA-f36v-x2cg-pr97: In the Linux kernel, the following vulnerability has been resolved:
drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_i
In the Linux kernel, the following vulnerability has been resolved:
drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl()
Since GEM bo handles are u32 in the uapi and the internal implementation
uses idr_alloc() which uses int ranges, passing a new handle larger than
INT_MAX trivially triggers a kernel warning:
idr_alloc():
...
if (WARN_ON_ONCE(start < 0))
return -EINVAL;
...
Fix it by rejecting new handles above INT_MAX and at the same time make
the end limit calculation more obvious by moving into int domain.
OSV
CVE-2026-23149: In the Linux kernel, the following vulnerability has been resolved: drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_io
osv·2026-02-14·CVSS 5.5
CVE-2026-23149 [MEDIUM] CVE-2026-23149: In the Linux kernel, the following vulnerability has been resolved: drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_io
In the Linux kernel, the following vulnerability has been resolved: drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() Since GEM bo handles are u32 in the uapi and the internal implementation uses idr_alloc() which uses int ranges, passing a new handle larger than INT_MAX trivially triggers a kernel warning: idr_alloc(): ... if (WARN_ON_ONCE(start < 0)) return -EINVAL; ... Fix it by rejecting new handles above INT_MAX and at the same time make the end limit calculation more obvious by moving into int domain.
Red Hat
kernel: drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl()
vendor_redhat·2026-02-14·CVSS 5.5
CVE-2026-23149 [MEDIUM] CWE-681 kernel: drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl()
kernel: drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl()
In the Linux kernel, the following vulnerability has been resolved:
drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl()
Since GEM bo handles are u32 in the uapi and the internal implementation
uses idr_alloc() which uses int ranges, passing a new handle larger than
INT_MAX trivially triggers a kernel warning:
idr_alloc():
...
if (WARN_ON_ONCE(start < 0))
return -EINVAL;
...
Fix it by rejecting new handles above INT_MAX and at the same time make
the end limit calculation more obvious by moving into int domain.
A flaw was found in the Linux kernel's DRM (Direct Rendering Manager) subsystem. In the drm_gem_change_handle_ioctl() function, userspace can trigger a
Debian
CVE-2026-23149: linux - In the Linux kernel, the following vulnerability has been resolved: drm: Do not...
vendor_debian·2026·CVSS 5.5
CVE-2026-23149 [MEDIUM] CVE-2026-23149: linux - In the Linux kernel, the following vulnerability has been resolved: drm: Do not...
In the Linux kernel, the following vulnerability has been resolved: drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() Since GEM bo handles are u32 in the uapi and the internal implementation uses idr_alloc() which uses int ranges, passing a new handle larger than INT_MAX trivially triggers a kernel warning: idr_alloc(): ... if (WARN_ON_ONCE(start < 0)) return -EINVAL; ... Fix it by rejecting new handles above INT_MAX and at the same time make the end limit calculation more obvious by moving into int domain.
Scope: local
bookworm: resolved
bullseye: resolved
forky: resolved (fixed in 6.18.9-1)
sid: resolved (fixed in 6.18.9-1)
trixie: resolved
No detection rules found.
No public exploits indexed.
Wiz
CVE-2026-23149 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 5.5
CVE-2026-23149 [MEDIUM] CVE-2026-23149 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-23149 :
Linux Kernel vulnerability analysis and mitigation
In the Linux kernel, the following vulnerability has been resolved:
drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl()
Since GEM bo handles are u32 in the uapi and the internal implementation
uses idr_alloc() which uses int ranges, passing a new handle larger than
INT_MAX trivially triggers a kernel warning:
idr_alloc():
...
if (WARN_ON_ONCE(start < 0))
return -EINVAL;
...
Fix it by rejecting new handles above INT_MAX and at the same time make
the end limit calculation more obvious by moving into int domain.
Source : NVD
## 5.5
Score
Published February 14, 2026
Severity MEDIUM
CNA Score N/A
Affected Technologies
Linux Kernel
Linux Debian
Has Public Exploit No
Has C
Bugzilla
CVE-2026-23149 kernel: drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl()
bugzilla·2026-02-14·CVSS 5.5
CVE-2026-23149 [MEDIUM] CVE-2026-23149 kernel: drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl()
CVE-2026-23149 kernel: drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl()
In the Linux kernel, the following vulnerability has been resolved:
drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl()
Since GEM bo handles are u32 in the uapi and the internal implementation
uses idr_alloc() which uses int ranges, passing a new handle larger than
INT_MAX trivially triggers a kernel warning:
idr_alloc():
...
if (WARN_ON_ONCE(start < 0))
return -EINVAL;
...
Fix it by rejecting new handles above INT_MAX and at the same time make
the end limit calculation more obvious by moving into int domain.
Discussion:
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2026021413-CVE-2026-23149-8329@gregkh/T
2026-02-14
Published