---
id: CVE-2026-23149
title: >-
  drm: Do not allow userspace to trigger kernel warnings in
  drm_gem_change_handle_ioctl()
summary: >-
  In the Linux kernel, the following vulnerability has been resolved:


  drm: Do not allow userspace to trigger kernel warnings in
  drm_gem_change_handle_ioctl()


  Since GEM bo handles are u32 in the uapi and the internal implementation

  uses i…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 53096728b8910c6916ecc6c46a5abc5c678b58d9 <
    ae8831ee0fb2f5f41f39722e7b3749d65bb78d08
  - >-
    Linux >= 53096728b8910c6916ecc6c46a5abc5c678b58d9 <
    12f15d52d38ac53f7c70ea3d4b3d76afed04e064
  - Linux 6.18
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-05T21:20:50.342571Z'
published: '2026-02-14'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T21:23:19.508Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-23149'
references:
  - url: 'https://git.kernel.org/stable/c/ae8831ee0fb2f5f41f39722e7b3749d65bb78d08'
  - url: 'https://git.kernel.org/stable/c/12f15d52d38ac53f7c70ea3d4b3d76afed04e064'
tags:
  - cve.org
epss: 0.00118
epssPercentile: 0.0171
ingestedAt: '2026-11-05T22:38:32.077Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl()

Since GEM bo handles are u32 in the uapi and the internal implementation
uses idr_alloc() which uses int ranges, passing a new handle larger than
INT_MAX trivially triggers a kernel warning:

idr_alloc():
...
	if (WARN_ON_ONCE(start < 0))
		return -EINVAL;
...

Fix it by rejecting new handles above INT_MAX and at the same time make
the end limit calculation more obvious by moving into int domain.

## Affected

- `Linux >= 53096728b8910c6916ecc6c46a5abc5c678b58d9 < ae8831ee0fb2f5f41f39722e7b3749d65bb78d08`
- `Linux >= 53096728b8910c6916ecc6c46a5abc5c678b58d9 < 12f15d52d38ac53f7c70ea3d4b3d76afed04e064`
- `Linux 6.18`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.