Update: 2026-07-24
Update: 2026-07-23
Date: 2026-07-23
An important flaw in the Linux kernel’s Direct Rendering Manager (DRM)
subsystem allows a local attacker to achieve arbitrary code execution
or privilege escalation. It is extensively described at [R 1].
EGI SVG ID : EGI-SVG-2026-33
CVE ID : CVE-2026-46215
CVSSv3 Score:
Sites are advised to update as soon as possible the Linux kernel on hosts giving access to unprivileged users, e.g. grid worker nodes, but also container hosts, notebook servers and CI runners.
At the time of writing, fixed kernels are available for only a few of the relevant distributions. Please check the references listed at the bottom of this advisory for your distribution(s), update and reboot affected systems as soon as feasible. Fixes are available for RHEL [R 2].
Given that the exploit published in [R 1] does not seem to work on “EL” 9, we do not yet advise denying access to unprivileged users, but will keep monitoring the case for new developments. Also see the mitigation below.
On hosts that do not need a GPU driver or on which it can temporarily be made unavailable as a mitigation, the “drm” module can be disabled:
modprobe -r drm || echo A reboot is needed for the mitigation to work
cat >/etc/modprobe.d/mitigation-cve-2026-46215.conf <<'EOF'
install drm /bin/false
blacklist drm
EOF
TLP:CLEAR information - Unlimited distribution
https://advisories.egi.eu/Advisory-EGI-SVG-2026-33
https://advisories.egi.eu/Advisory-SVG-CVE-2026-46215
Minor updates may be made without re-distribution to the sites.
This advisory is subject to the Creative Commons licence
https://creativecommons.org/licenses/by/4.0/ and
the EGI (https://www.egi.eu/) Software Vulnerability Group
must be credited. -----------------------------
Comments or questions should be sent to svg-rat at mailman.egi.eu
Vulnerabilities relevant for EGI can be reported at report-vulnerability at egi.eu
See [R 99] for further details, and other information on SVG.
SVG was alerted to this vulnerability by Laurent Caillat-Vallet (EGI CSIRT)