CVE-2026-46215PoC(linux / linux_kernel)

HIGHCVSS 7.8 · HIGH

Exploitation observed; activity peaked at 3 mentions and remains active

Immediate actions

Patch linux linux_kernel systems immediately
Assume compromise if assets are exposed
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: Immediate (within 24h)

NVD description

In the Linux kernel, the following vulnerability has been resolved: drm: Set old handle to NULL before prime swap in change_handle There was a potential race condition in change_handle. The ioctl briefly had a single object with two idr entries; a concurrent gem_close could delete the object and remove one of the handles while leaving the other one dangling, which could subsequently be dereferenced for a use-after-free. To fix this, do the same dance that gem_close itself does. (f6cd7daecff5 drm: Release driver references to handle before making it available again) First idr_replace the old handle to NULL. Later, if the prime operations are successful, actually close it. create_tail required a similar dance to avoid a similar problem. (bd46cece51a3 drm/gem: Fix race in drm_gem_handle_create_tail()) It idr_allocs the new handle with NULL, then swaps in the correct object later to avoid races. We don't need to do that here, since the only operations that could race are drm_prime, and change_handle holds the prime lock for the entire duration. v2: cleanups of error paths

linux CVEs Back to dashboard

7.8/ 10 priority

Sources & remediation

Patch / fix

Other references

https://github.com/0xCyberstan/CVE-2026-46215-POC

Weakness type (CWE)

CWE-416

Priority

HIGH

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

linux_kernel

Threat summary

Active exploitation appears in 1 classified signals
Public PoC and exploit tooling are both present
Patch or workaround signal is available
13 mentions across 9 observed days

What's happening

Active exploitation reported across 1 signal
Exploit tool or code specified in 4 signals
PoC mentioned or linked in 11 signals
Patch or workaround mentioned in 3 signals
Technical details provided in 12 signals
Disclosure: 2 classified signals
Peaked 3d ago at 3 mentions (2026-07-09); latest day: 1
13 total mentions across 9 days

Affected systems

Vendors

linux

Products

linux_kernel

1 version affected across 1 product

Deep dive

Activity timeline13 mentions / 9d

Signal classification4 categories

PoC

753.8%

Disclosure

215.4%

Patch

215.4%

Exploit

215.4%

Referenced assets11 URLs

By indicator

Classification over time

Date	Total	Labels

2026-05-28	1	Disclosure1
2026-06-23	1	PoC1
2026-06-29	2	PoC2
2026-06-30	1	Patch1
2026-07-02	2	PoC2
2026-07-09	3	Patch1PoC2
2026-07-12	1	Exploit1
2026-07-19	1	Exploit1
2026-07-29	1	Disclosure1

Full discourse13 posts

Daily CyberSecurity@Daily_CyberSec95d
PoC
Public PoC and write-up detail a Linux kernel privilege escalation flaw (CVE-2026-46215) in DRM GEM. A local user gets root in ~99% of runs. #Linux #KernelSecurity #CVE202646215 #PrivilegeEscalation #DRM http://securityonline.info/linux-kernel-privilege-escalation-cve-2026-46215/
Post summary
A public proof‑of‑concept and write‑up expose a Linux kernel privilege escalation flaw in the DRM GEM subsystem, with a local user achieving root in roughly 99% of attempts.
029195508.7K
12.9K followersView on X
Linux Kernel Security@linkersec105d
PoC
Unprivileged root via a use-after-free in DRM GEM change_handle (CVE-2026-46215) Stan Shaw published an article about exploiting UAF in a DRM GEM ioctl. The researcher reallocated freed memory as a pipe_buffer array to perform the Dirty Pipe attack. https://cyberstan.co.uk/drm-lpe-linux/ https://t.co/evEykrjei4
Post summary
Stan Shaw explains a use‑after‑free in DRM GEM that enables root via a Dirty Pipe technique, showcasing a PoC exploit in an online article. No patch, tool code, or active exploitation claims are present.
015089434.7K
10.5K followersView on X
Blackstorm Security@blackstormsecbr102d
PoC
Unprivileged root via a use-after-free in DRM GEM change_handle (CVE-2026-46215): https://cyberstan.co.uk/drm-lpe-linux/ #linux #exploitation #vulnerability #cve https://t.co/L8CxUhqmST
Post summary
The post announces CVE‑2026‑46215, a use‑after‑free that grants unprivileged root, and provides a link that likely contains a Proof of Concept, without indicating active exploitation or a patch.
020124843
2.4K followersView on X
bluedragonsec@bluedragonsec92d
Exploit
CVE-2026-46215 Exploit for Linux 7.0 This is and exploit for CVE-2026-46215 (Linux Kernel Use After Free) Adapted for Linux 7.0 !!! WARNING !!! this exploit is not stable ! sometimes, this exploit might cause kernel panic ! you have been warned !!! ;-p https://github.com/bluedragonsecurity/CVE-2026-46215-EXPLOIT https://t.co/HimToy7J7N
Post summary
The message announces a publicly available exploit for CVE-2026-46215, includes a GitHub link to the code, specifies the vulnerability type, but does not mention patches or active exploitation.
00001119
64 followersView on X
The Daily Tech Feed@dailytechonx95d
Patch
A critical Linux kernel vulnerability (CVE-2026-46215) allowed local users to escalate privileges to root via DRM render nodes. This flaw, present from v6.18-rc1, was patched in May 2026. System administrators should ensure systems are updated to mitigate this risk. #LinuxKernel #Security #CVE202646215 #DRM #RootAccess #CyberSecurity https://thedailytechfeed.com/linux-kernel-flaw-grants-passwordless-root-access-via-drm-render-nodes/
Post summary
The post reports that CVE-2026-46215—a Linux kernel privilege escalation flaw via DRM render nodes—was patched in May 2026 and urges admins to apply updates.
0001095
500 followersView on X
UNDERCODE TESTING@UndercodeUpdate103d
PoC
🚨 #CVE-2026-46215: The Unprivileged Root via a DRM UAF That Bypasses KASAN + Video https://undercodetesting.com/cve-2026-46215-the-unprivileged-root-via-a-drm-uaf-that-bypasses-kasan-video/ Educational Purposes!
Post summary
The tweet promotes a Proof of Concept for CVE‑2026‑46215 that targets a DRM use‑after‑free to gain unprivileged root while bypassing KASAN, with a link for educational use; no active exploitation, patch, or false positive claims are provided.
0000168
651 followersView on X
Komodo Cyber Security@Komodosec75d
Disclosure
Unprivileged root via a use-after-free in DRM GEM change_handle (CVE-2026-46215) https://cyberstan.co.uk/drm-lpe-linux/?utm_source=dlvr.it&utm_medium=twitter
Post summary
The tweet announces CVE-2026-46215, an unprivileged root vulnerability via a use‑after‑free in DRM GEM change_handle, with a link to a blog post that likely contains a PoC, but no active exploitation, patch, or debunking is noted.
0000074
1.5K followersView on X
bluedragonsec@bluedragonsec85d
Exploit
https://github.com/bluedragonsecurity/CVE-2026-46215-exploit-linux-7.0-uaf-stable This UAF exploit for linux 7.0 is more stable and reliable (requirements are needed, read the README) https://t.co/GHPeokrxDP
Post summary
A stable, reliable Use‑After‑Free exploit for Linux 7.0 (CVE‑2026‑46215) is available on GitHub, with usage details in the README.
0000064
61 followersView on X
TECHEPAGES@techepages95d
PoC
🚨 CVE-2026-46215 — Linux kernel local privilege-escalation vulnerability Public PoC now available for the DRM GEM use-after-free that lets any logged-in desktop user reach root. Reportedly high reliability, so treat this as actively exploitable. ✅ Fixed upstream; ioctl removed in 7.1. Patch multi-user systems now.
Post summary
CVE-2026-46215 is a Linux kernel local privilege‑escalation flaw via a DRM GEM use‑after‑free; a public PoC exists, the vulnerability is deemed reliably exploitable, and a patch has been deployed upstream.
0000066
19 followersView on X
su8 / denchu@__su888104d
Patch
Linux DRMのGEM change_handle ioctlにUAF(CVE-2026-46215)。renderノードを開ける一般ユーザーがroot昇格可能。handle_count未更新の競合が原因。v6.18-rc1で混入し6.18.32で修正、7.1でioctl廃止 / Unprivileged root via a use-after-free in DRM GEM change_handle https://cyberstan.co.uk/drm-lpe-linux/ https://t.co/nzfkc8KQyM
Post summary
The post announces a UAF vulnerability in Linux DRM that allows unprivileged users to become root, provides version‑specific fix references, and links to a detail article.
00000110
840 followersView on X
-ENOMEM@masami256105d
PoC
Unprivileged root via a use-after-free in DRM GEM change_handle (CVE-2026-46215) – cyberstan https://cyberstan.co.uk/drm-lpe-linux/
Post summary
The post announces a use-after-free vulnerability in Linux DRM that enables unprivileged users to achieve root, with a linked blog likely containing PoC details.
00000189
2.4K followersView on X
dbugs@ptdbugs111d
PoC
drm: Set old handle to NULL before prime swap in change_handle CVE: CVE-2026-46215 PT ID: PT-2026-44338 Vendor: Linux Product: Linux CVSS: 7.8 Credits: n/a Description: A race condition exists in the Direct Rendering Manager (DRM) within the "change handle" function. The issue occurs when an ioctl briefly associates a single object with two idr entries. A concurrent "gem close()" function call could delete the object and remove one handle while leaving the other dangling. This leads to a use-after-free scenario when the dangling handle is subsequently dereferenced. References: • https://dbugs.ptsecurity.com/vulnerability/CVE-2026-46215 • https://git.kernel.org/stable/c/672464dd53231509c9c771110798c56d4660e19e PoC/Exploit: https://github.com/0xCyberstan/CVE-2026-46215-POC #dbugs_vuln
Post summary
A race condition in Linux DRM creates a use‑after‑free vulnerability (CVE‑2026‑46215) with a published PoC, yet no active exploitation or patch has been reported.
00000351
1.8K followersView on X
Vulmon Vulnerability Feed@VulmonFeeds137d
Disclosure
CVE-2026-46215 Race Condition in Linux Kernel DRM Handle Change Leading to Use-After-Free https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-46215
Post summary
A new race condition vulnerability (CVE-2026-46215) in the Linux Kernel DRM subsystem leading to use‑after‑free is announced, with a link to details but no proof‑of‑concept, exploit, or patch information.
0000064
4.0K followersView on X

CPE platform detail3 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

3 of 3 entries

Part	Vendor	Product	Version	Target SW	Target HW
OS	linux	linux_kernel	-	-	-
OS	linux	linux_kernel	7.1	-	-
OS	linux	linux_kernel	7.1	-	-

Explore more

Back to dashboard linux CVEs linux_kernel vulnerabilities

What researchers are saying

CVE-2026-46215

bluedragonsec[verified]@bluedragonsecExploit

The message announces a publicly available exploit for CVE-2026-46215, includes a GitHub link to the code, specifies the vulnerability type, but does not mention patches or active exploitation.

The Daily Tech Feed[verified]@dailytechonxPatch

The post reports that CVE-2026-46215—a Linux kernel privilege escalation flaw via DRM render nodes—was patched in May 2026 and urges admins to apply updates.

UNDERCODE TESTING[verified]@UndercodeUpdatePoC

The tweet promotes a Proof of Concept for CVE‑2026‑46215 that targets a DRM use‑after‑free to gain unprivileged root while bypassing KASAN, with a link for educational use; no active exploitation, patch, or false positive claims are provided.

Komodo Cyber Security[verified]@KomodosecDisclosure

The tweet announces CVE-2026-46215, an unprivileged root vulnerability via a use‑after‑free in DRM GEM change_handle, with a link to a blog post that likely contains a PoC, but no active exploitation, patch, or debunking is noted.

bluedragonsec[verified]@bluedragonsecExploit

A stable, reliable Use‑After‑Free exploit for Linux 7.0 (CVE‑2026‑46215) is available on GitHub, with usage details in the README.

TECHEPAGES[verified]@techepagesPoC

CVE-2026-46215 is a Linux kernel local privilege‑escalation flaw via a DRM GEM use‑after‑free; a public PoC exists, the vulnerability is deemed reliably exploitable, and a patch has been deployed upstream.

dbugs[verified]@ptdbugsPoC

A race condition in Linux DRM creates a use‑after‑free vulnerability (CVE‑2026‑46215) with a published PoC, yet no active exploitation or patch has been reported.

Daily CyberSecurity@Daily_CyberSecPoC

A public proof‑of‑concept and write‑up expose a Linux kernel privilege escalation flaw in the DRM GEM subsystem, with a local user achieving root in roughly 99% of attempts.