PoC and Technical Details Released for Linux Kernel Privilege Escalation Vulnerability

A researcher has published proof-of-concept exploit code and a full technical breakdown of a Linux kernel vulnerability that lets any logged-in desktop user escalate to root, requiring no special privileges, no container escape, and no setuid helper. The flaw, tracked as CVE-2026-46215, lives in the Direct Rendering Manager (DRM) Graphics Execution Manager (GEM) subsystem and […] The post PoC and Technical Details Released for Linux Kernel Privilege Escalation Vulnerability appeared first on Cyber Security News.

A researcher has published proof-of-concept exploit code and a full technical breakdown of a Linux kernel vulnerability that lets any logged-in desktop user escalate to root, requiring no special privileges, no container escape, and no setuid helper. The flaw, tracked as CVE-2026-46215, lives in the Direct Rendering Manager (DRM) Graphics Execution Manager (GEM) subsystem and stems from a use-after-free triggered by a race condition in a relatively new ioctl. Linux Kernel Privilege Escalation Vulnerability The bug centers on DRM_IOCTL_GEM_CHANGE_HANDLE, which was added in Linux v6.18-rc1 to support AMD’s CRIU checkpoint/restore infrastructure. The ioctl moves a GEM buffer object from one handle to another but does so by directly manipulating the object’s IDR (ID allocator) entries instead of using the kernel’s existing handle-lifecycle helpers—drm_gem_handle_create_tail() and drm_gem_handle_delete()—which are specifically designed to keep the object’s handle_count in sync with its lookup table. Because change_handle never touches handle_count, there is a brief window where the object has two live IDR entries while the count still reads 1. If a second thread calls DRM_IOCTL_GEM_CLOSE on the old handle during that window, it drives handle_count to zero and frees the object, leaving the new handle dangling and pointing at freed memory. The published exploit chain reclaims the freed slot with a sprayed pipe_buffer array, leaks a kernel pointer to defeat KASLR, sets PIPE_BUF_FLAG_CAN_MERGE to sidestep the original DirtyPipe mitigation, and uses that to overwrite a read-only /etc/passwd through the page cache. This achieves passwordless root with a reported ~99% success rate. The complete reverse-engineered code path, memory allocations, and proof-of-concept walkthrough are hosted directly on the security research blog DRM Local Privilege Escalation in Linux – cyberstan. Both ioctls carry the DRM_RENDER_ALLOW flag, meaning they are reachable from /dev/dri/renderD*, the render node that systemd-logind grants read/write access to for any active desktop session by default. This design makes it an accessible local privilege-escalation surface: an ordinary logged-in user can win the race and take over the freed kernel object. Local privilege escalation mechanisms like this continue to pose an important challenge to corporate infrastructure, prompting desktop and data-center teams to track essential security updates across enterprise operating systems. Vulnerable ComponentUnderlying Code FlawRoot Security WeaknessDefensive Remediation StrategyDRM GEM SubsystemManual IDR manipulation bypassing standard lifecycle helpersExpired pointer dereference / Use-After-Free (CWE-825)Prevent the drm kernel module from loading if rendering nodes are not required.Render Node HandlingDRM_RENDER_ALLOW flag availabilityUnprivileged local access to race-prone ioctl vectorsRestrict default session permissions to /dev/dri/renderD* objects. The researcher independently discovered and reported the bug to security@kernel.org on April 12, 2026, but credit for the upstream fix and the CVE assignment went to Puttimet Thammasaeng, who reported the same issue first. The fix, authored by David Francis (AMD) with Dave Airlie, closes the race with a two-stage idr_replace() approach that prevents the new handle from ever referencing a live object during the vulnerable window, backing out cleanly if a concurrent close wins. Rather than continuing to patch a niche, race-prone interface, maintainers opted to remove DRM_IOCTL_GEM_CHANGE_HANDLE entirely in the upcoming 7.1 release. Administrators running affected kernels should prioritize patching, particularly on multi-user or shared desktop systems where render-node access is common. Tracking localized access boundaries remains critical for preventing standard users from escalating permissions, much like auditing the security limits established within modern client-side application isolation models. The post PoC and Technical Details Released for Linux Kernel Privilege Escalation Vulnerability appeared first on Cyber Security News.