In the Linux kernel, the following vulnerability has been resolved: drm/gem: fix race between change_handle and handle_delete drm_gem_change_handle_ioctl leaves the old handle live in the IDR during the window between spin_unlock(table_lock) and the final spin_lock(table_lock). A concurrent drm_gem_handle_delete on the old handle succeeds in this window, decrements handle_count to 0, and frees the GEM object while the new handle's IDR entry still references it. NULL the old handle's IDR entry before dropping table_lock so that any concurrent GEM_CLOSE on the old handle sees NULL and returns -EINVAL. Restore the old entry on the prime-bookkeeping error path.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - In the Linux kernel, the following vulnerability has been resolved: drm/gem: fix race between
    change_handle and handle_delete drm_gem_change_handle_ioctl leaves the old handle live in the IDR during
    the window between spin_unlock(table_lock) and the final spin_lock(table_lock). A concurrent
    drm_gem_handle_delete on the old handle succeeds in this window, decrements handle_count to 0, and frees
    the GEM object while the new handle's IDR entry still references it. NULL the old handle's IDR entry
    before dropping table_lock so that any concurrent GEM_CLOSE on the old handle sees NULL and returns
    -EINVAL. Restore the old entry on the prime-bookkeeping error path. (CVE-2026-63885)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In the Linux kernel, the following vulnerability has been resolved: drm/gem: fix race between     change_handle and handle_delete drm_gem_change_handle_ioctl leaves the old handle live in the IDR during     the window between spin_unlock(table_lock) and the final spin_lock(table_lock). A concurrent     drm_gem_handle_delete on the old handle succeeds in this window, decrements handle_count to 0, and frees     the GEM object while the new handle's IDR entry still references it. NULL the old handle's IDR entry     before dropping table_lock so that any concurrent GEM_CLOSE on the old handle sees NULL and returns
    -EINVAL. Restore the old entry on the prime-bookkeeping error path. (CVE-2026-63885)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
471393	Google: sys-kernel/cchost-kernel-6_18, sys-kernel/csql-kernel-6_18, sys-kernel/lakitu-kernel-6_18, sys-kernel/lakitu-nc-kernel-6_18: security update to 19862.0.0	Tenable Cloud Security	Google COS Security Checks	Local	high
471393	Google: sys-kernel/cchost-kernel-6_18, sys-kernel/csql-kernel-6_18, sys-kernel/lakitu-kernel-6_18, sys-kernel/lakitu-nc-kernel-6_18: security update to 19862.0.0	Tenable Self-Hosted Container Security	Google COS Security Checks	Local	high
328099	Linux Distros Unpatched Vulnerability : CVE-2026-63885	Nessus	Misc.	Local	high
322087	Amazon Linux 2023 : bpftool6.18, kernel6.18, kernel6.18-devel (ALAS2023-2026-1881)	Nessus	Amazon Linux Local Security Checks	Local	high

Detections

Analytics

CVE-2026-63885

high

Tenable Plugins

high

high

high

high