CVE-2026-46215 (GCVE-0-2026-46215)

Vulnerability from cvelistv5 – Published: 2026-05-28 09:40 – Updated: 2026-08-05 12:30
VLAI
Title
drm: Set old handle to NULL before prime swap in change_handle
Summary
In the Linux kernel, the following vulnerability has been resolved: drm: Set old handle to NULL before prime swap in change_handle There was a potential race condition in change_handle. The ioctl briefly had a single object with two idr entries; a concurrent gem_close could delete the object and remove one of the handles while leaving the other one dangling, which could subsequently be dereferenced for a use-after-free. To fix this, do the same dance that gem_close itself does. (f6cd7daecff5 drm: Release driver references to handle before making it available again) First idr_replace the old handle to NULL. Later, if the prime operations are successful, actually close it. create_tail required a similar dance to avoid a similar problem. (bd46cece51a3 drm/gem: Fix race in drm_gem_handle_create_tail()) It idr_allocs the new handle with NULL, then swaps in the correct object later to avoid races. We don't need to do that here, since the only operations that could race are drm_prime, and change_handle holds the prime lock for the entire duration. v2: cleanups of error paths
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: poc Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-09 00:00 UTC
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 53096728b8910c6916ecc6c46a5abc5c678b58d9 , < 672464dd53231509c9c771110798c56d4660e19e (git)
Affected: 53096728b8910c6916ecc6c46a5abc5c678b58d9 , < 61bd96d3e5472c253f9c1ab77608f0c8aaa9d025 (git)
Affected: 53096728b8910c6916ecc6c46a5abc5c678b58d9 , < 5e28b7b94408897e41c63477aabc9e1db439bc8c (git)
Create a notification for this product.
Linux Linux Affected: 6.18
Unaffected: 0 , < 6.18 (semver)
Unaffected: 6.18.32 , ≤ 6.18.* (semver)
Unaffected: 7.0.9 , ≤ 7.0.* (semver)
Unaffected: 7.1 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-46215",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-09T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-10T03:55:46.719Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/0xCyberstan/CVE-2026-46215-POC"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/drm_gem.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "672464dd53231509c9c771110798c56d4660e19e",
              "status": "affected",
              "version": "53096728b8910c6916ecc6c46a5abc5c678b58d9",
              "versionType": "git"
            },
            {
              "lessThan": "61bd96d3e5472c253f9c1ab77608f0c8aaa9d025",
              "status": "affected",
              "version": "53096728b8910c6916ecc6c46a5abc5c678b58d9",
              "versionType": "git"
            },
            {
              "lessThan": "5e28b7b94408897e41c63477aabc9e1db439bc8c",
              "status": "affected",
              "version": "53096728b8910c6916ecc6c46a5abc5c678b58d9",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/drm_gem.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.18"
            },
            {
              "lessThan": "6.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.32",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.32",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.9",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm: Set old handle to NULL before prime swap in change_handle\n\nThere was a potential race condition in change_handle. The ioctl\nbriefly had a single object with two idr entries; a concurrent\ngem_close could delete the object and remove one of the handles\nwhile leaving the other one dangling, which could subsequently\nbe dereferenced for a use-after-free.\n\nTo fix this, do the same dance that gem_close itself does.\n(f6cd7daecff5 drm: Release driver references to handle before making it available again)\nFirst idr_replace the old handle to NULL. Later, if the prime\noperations are successful, actually close it.\n\ncreate_tail required a similar dance to avoid a similar problem.\n(bd46cece51a3 drm/gem: Fix race in drm_gem_handle_create_tail())\nIt idr_allocs the new handle with NULL, then swaps in the correct\nobject later to avoid races. We don\u0027t need to do that here, since\nthe only operations that could race are drm_prime, and\nchange_handle holds the prime lock for the entire duration.\n\nv2: cleanups of error paths"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached only via the DRM_IOCTL_GEM_CHANGE_HANDLE ioctl on a local DRM device node (/dev/dri/renderD* or card*); there is no network or remote path to this code.\nAC:L - This is a race condition where the attacker controls both racing threads (one issuing GEM_CHANGE_HANDLE, another GEM_CLOSE on the same fd) and can retry the ioctls indefinitely, so the window is reliably winnable.\nPR:L - The ioctl is flagged DRM_RENDER_ALLOW with no DRM_AUTH/DRM_MASTER/DRM_ROOT_ONLY and no capability check, so any unprivileged local user with access to a DRM render node (standard on desktops/Android/kiosks) can trigger it.\nUI:N - The attacker drives the entire exploit through its own ioctls; no action by another user or victim is required.\nS:U - The use-after-free corrupts kernel heap memory within the same kernel security authority; it does not cross a VM/hypervisor or IOMMU boundary.\nC:H - A use-after-free on a heap-allocated drm_gem_object lets the attacker reclaim the freed slot with controlled data and read back object contents/pointers, enabling kernel memory disclosure.\nI:H - The dangling idr entry is dereferenced (kref_get write, plus obj-\u003efuncs-\u003e* calls), and a reclaimed UAF object gives heap-spray-based arbitrary write and control-flow hijacking primitives.\nA:H - Dereferencing the freed/dangling GEM object reliably causes kernel oops/panic, a full denial of service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:30:33.895Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/672464dd53231509c9c771110798c56d4660e19e"
        },
        {
          "url": "https://git.kernel.org/stable/c/61bd96d3e5472c253f9c1ab77608f0c8aaa9d025"
        },
        {
          "url": "https://git.kernel.org/stable/c/5e28b7b94408897e41c63477aabc9e1db439bc8c"
        }
      ],
      "title": "drm: Set old handle to NULL before prime swap in change_handle",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-46215",
    "datePublished": "2026-05-28T09:40:32.050Z",
    "dateReserved": "2026-05-13T15:03:33.105Z",
    "dateUpdated": "2026-08-05T12:30:33.895Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-46215",
      "date": "2026-08-13",
      "epss": "0.00227",
      "percentile": "0.13594"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-46215\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-05-28T10:16:37.147\",\"lastModified\":\"2026-07-10T05:16:37.103\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm: Set old handle to NULL before prime swap in change_handle\\n\\nThere was a potential race condition in change_handle. The ioctl\\nbriefly had a single object with two idr entries; a concurrent\\ngem_close could delete the object and remove one of the handles\\nwhile leaving the other one dangling, which could subsequently\\nbe dereferenced for a use-after-free.\\n\\nTo fix this, do the same dance that gem_close itself does.\\n(f6cd7daecff5 drm: Release driver references to handle before making it available again)\\nFirst idr_replace the old handle to NULL. Later, if the prime\\noperations are successful, actually close it.\\n\\ncreate_tail required a similar dance to avoid a similar problem.\\n(bd46cece51a3 drm/gem: Fix race in drm_gem_handle_create_tail())\\nIt idr_allocs the new handle with NULL, then swaps in the correct\\nobject later to avoid races. We don\u0027t need to do that here, since\\nthe only operations that could race are drm_prime, and\\nchange_handle holds the prime lock for the entire duration.\\n\\nv2: cleanups of error paths\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/gpu/drm/drm_gem.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"53096728b8910c6916ecc6c46a5abc5c678b58d9\",\"lessThan\":\"672464dd53231509c9c771110798c56d4660e19e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"53096728b8910c6916ecc6c46a5abc5c678b58d9\",\"lessThan\":\"61bd96d3e5472c253f9c1ab77608f0c8aaa9d025\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"53096728b8910c6916ecc6c46a5abc5c678b58d9\",\"lessThan\":\"5e28b7b94408897e41c63477aabc9e1db439bc8c\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/gpu/drm/drm_gem.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.18\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.18\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.32\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.0.9\",\"lessThanOrEqual\":\"7.0.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-07-09T00:00:00+00:00\",\"id\":\"CVE-2026-46215\",\"options\":[{\"exploitation\":\"poc\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.18\",\"versionEndExcluding\":\"6.18.32\",\"matchCriteriaId\":\"C29FBB84-11C5-4598-8812-17C64D98F7F9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.19\",\"versionEndExcluding\":\"7.0.9\",\"matchCriteriaId\":\"33ACA10B-B260-46EA-BD50-70EBE5097672\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"B1EF7059-E670-45F4-B422-54C40FA86390\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"0D38F0BF-A728-4133-A358-D44A2F7EE6D6\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/5e28b7b94408897e41c63477aabc9e1db439bc8c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/61bd96d3e5472c253f9c1ab77608f0c8aaa9d025\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/672464dd53231509c9c771110798c56d4660e19e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/0xCyberstan/CVE-2026-46215-POC\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-07-22T14:41:59+00:00",
      "cve": "CVE-2026-46215",
      "id": "CVE-2026-46215",
      "initial_release_date": "2026-05-28T00:00:00+00:00",
      "product_status:fixed": "612",
      "product_status:known_affected": "22",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: drm: Set old handle to NULL before prime swap in change_handle",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46215.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-08-06T01:17:27Z",
      "cve": "CVE-2026-46215",
      "id": "CVE-2026-46215",
      "initial_release_date": "2026-05-29T01:14:58Z",
      "product_status:known_not_affected": "293",
      "product_status:recommended": "87",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-46215",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-46215.json",
      "version": "7"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-46215\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-07-09T17:58:20.077435Z\"}}}], \"references\": [{\"url\": \"https://github.com/0xCyberstan/CVE-2026-46215-POC\", \"tags\": [\"exploit\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-07-09T17:58:12.669Z\"}}], \"cna\": {\"title\": \"drm: Set old handle to NULL before prime swap in change_handle\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"53096728b8910c6916ecc6c46a5abc5c678b58d9\", \"lessThan\": \"672464dd53231509c9c771110798c56d4660e19e\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"53096728b8910c6916ecc6c46a5abc5c678b58d9\", \"lessThan\": \"61bd96d3e5472c253f9c1ab77608f0c8aaa9d025\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"53096728b8910c6916ecc6c46a5abc5c678b58d9\", \"lessThan\": \"5e28b7b94408897e41c63477aabc9e1db439bc8c\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/gpu/drm/drm_gem.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.18\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.18\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.18.32\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.18.*\"}, {\"status\": \"unaffected\", \"version\": \"7.0.9\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.0.*\"}, {\"status\": \"unaffected\", \"version\": \"7.1\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/gpu/drm/drm_gem.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/672464dd53231509c9c771110798c56d4660e19e\"}, {\"url\": \"https://git.kernel.org/stable/c/61bd96d3e5472c253f9c1ab77608f0c8aaa9d025\"}, {\"url\": \"https://git.kernel.org/stable/c/5e28b7b94408897e41c63477aabc9e1db439bc8c\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm: Set old handle to NULL before prime swap in change_handle\\n\\nThere was a potential race condition in change_handle. The ioctl\\nbriefly had a single object with two idr entries; a concurrent\\ngem_close could delete the object and remove one of the handles\\nwhile leaving the other one dangling, which could subsequently\\nbe dereferenced for a use-after-free.\\n\\nTo fix this, do the same dance that gem_close itself does.\\n(f6cd7daecff5 drm: Release driver references to handle before making it available again)\\nFirst idr_replace the old handle to NULL. Later, if the prime\\noperations are successful, actually close it.\\n\\ncreate_tail required a similar dance to avoid a similar problem.\\n(bd46cece51a3 drm/gem: Fix race in drm_gem_handle_create_tail())\\nIt idr_allocs the new handle with NULL, then swaps in the correct\\nobject later to avoid races. We don\u0027t need to do that here, since\\nthe only operations that could race are drm_prime, and\\nchange_handle holds the prime lock for the entire duration.\\n\\nv2: cleanups of error paths\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.18.32\", \"versionStartIncluding\": \"6.18\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"7.0.9\", \"versionStartIncluding\": \"6.18\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"7.1\", \"versionStartIncluding\": \"6.18\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-06-14T18:03:19.611Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-46215\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-07-09T17:58:23.605Z\", \"dateReserved\": \"2026-05-13T15:03:33.105Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2026-05-28T09:40:32.050Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.