---
cve: "CVE-2026-23149"
severity: "LOW"
cvss: 3.1
epss: "10%"
vendor: "Linux"
kev: false
exploited: false
published: "2026-02-14 16:15:55"
tags: [cve, security, low]
source: tsecurity.de CVE-Dossier
exported: "2026-09-11T01:01:04+02:00"
---

# CVE-2026-23149

> 3.1 LOW

## Beschreibung

In the Linux kernel, the following vulnerability has been resolved:

drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl()

Since GEM bo handles are u32 in the uapi and the internal implementation
uses idr_alloc() which uses int ranges, passing a new handle larger than
INT_MAX trivially triggers a kernel warning:

idr_alloc():
...
	if (WARN_ON_ONCE(start < 0))
		return -EINVAL;
...

Fix it by rejecting new handles above INT_MAX and at the same time make
the end limit calculation more obvious by moving into int domain.

## Patch verfügbar (OSV)

- Kernel ≥ 6.18.9

## Referenzen

- <https://git.kernel.org/stable/c/ae8831ee0fb2f5f41f39722e7b3749d65bb78d08>
- <https://git.kernel.org/stable/c/12f15d52d38ac53f7c70ea3d4b3d76afed04e064>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/cve?cve=CVE-2026-23149) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI BITS_