We’re launching Lyria 3.5 in Google Flow Music, with advances across musicality, lyrics, vocals, and creative control
deepmind.google·6d ago
AI Engineering
Lobsters·Jun 29·5 min read
Unprivileged root via a use-after-free in DRM GEM change_handle (CVE-2026-46215)
TL;DR
A use-after-free vulnerability in the Direct Rendering Manager (DRM) allows unprivileged users to escalate their privileges to root. The vulnerability arises from the drm_gem_change_handle_ioctl function, which fails to update the handle count of a Graphics Execution Manager (GEM) object.
✦ Why It Matters
Engineers should prioritize fixing use-after-free vulnerabilities to prevent privilege escalation in their systems.
Key Takeaways
- Implement stricter memory management practices.
- Regularly audit kernel code for vulnerabilities.
- Limit access to render nodes for unprivileged users.
- Stay updated on security patches and CVEs.
Full Summary
The vulnerability, identified as CVE-2026-46215, exists in the DRM GEM core ioctl function drm_gem_change_handle_ioctl, which is responsible for managing graphics objects. When this function is called, it moves a GEM object to a new handle without properly updating its handle count, leading to a situation where the object can be freed while still being referenced.
This creates a use-after-free condition, allowing an attacker to exploit the freed object to gain root access. The exploit involves reclaiming the freed memory, leaking a kernel pointer to bypass Address Space Layout Randomization (KASLR), and overwriting critical system files.
The flaw is particularly dangerous because it can be accessed by any local user with access to a render node, which is typically granted by default on major Linux distributions. The researcher who reported this vulnerability demonstrated that it could lead to passwordless root access in approximately 99% of attempts.
This highlights the need for stricter access controls and better memory management in kernel code.