Linux: Multiple Releases of Same Resource or Handle
CVE-2026-52987 is a high-severity multiple releases of same resource or handle vulnerability in Linux, with a CVSS 3.1 base score of 7.8 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions c7c3ae7c01e5a0742b93cb9b40800bdd7f811e38, 508babf310365f1107a2e8831c267c292a286818 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.18% chance of exploitation within 30 days, which is low compared with other CVEs.
High severity with no evidence of exploitation so far.
What to do
- Update Linux to c7c3ae7c01e5a0742b93cb9b40800bdd7f811e38 or 508babf310365f1107a2e8831c267c292a286818, whichever matches your release line, or a later version.
- Update Linux Kernel to 7.0.10 or a later version.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| Linux | Linux | 42f148788469792df207751e2339ef2bb8a1e33e up to, but not including, c7c3ae7c01e5a0742b93cb9b40800bdd7f811e38; 42f148788469792df207751e2339ef2bb8a1e33e up to, but not including, 508babf310365f1107a2e8831c267c292a286818; 6.19 | c7c3ae7c01e5a0742b93cb9b40800bdd7f811e38, 508babf310365f1107a2e8831c267c292a286818 |
| Red Hat | Red Hat Enterprise Linux 10 | Not specified in the record | Not stated |
| Red Hat | Red Hat Enterprise Linux 6 | Not specified in the record | Not stated |
| Red Hat | Red Hat Enterprise Linux 7 | Not specified in the record | Not stated |
| Red Hat | Red Hat Enterprise Linux 8 | Not specified in the record | Not stated |
| Red Hat | Red Hat Enterprise Linux 9 | Not specified in the record | Not stated |
| Linux | Linux Kernel | 6.19 up to, but not including, 7.0.10; 7.1 | 7.0.10 |
Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- LocalThe attacker needs local access or must trick a user into running something.
- Attack complexity
- LowNo special conditions are needed; the attack works reliably.
- Privileges required
- LowA basic user account is enough.
- User interaction
- NoneNo action by a victim is required.
- Scope
- UnchangedImpact stays within the vulnerable component.
- Confidentiality
- HighAll data handled by the component can be read.
- Integrity
- HighData or code can be modified at will.
- Availability
- HighThe component can be taken down completely.
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by CNA.
| Scoring system | Score | Severity | Scored by |
|---|---|---|---|
| CVSS 3.1 | 7.8 | High | CNA |
| CVSS 3.1 | 7.0 | High | CNA |
Official description
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: avoid double drm_exec_fini() in userq validate When new_addition is true, amdgpu_userq_vm_validate() calls drm_exec_fini(&exec) before iterating over the collected HMM ranges and calling amdgpu_ttm_tt_get_user_pages(). If amdgpu_ttm_tt_get_user_pages() fails in that path, the code jumps to unlock_all and calls drm_exec_fini(&exec) a second time on the same exec object. drm_exec_fini() is not idempotent: it frees exec->objects and may also drop exec->contended and finalize the ww acquire context. Route that error path directly to the range cleanup once exec has already been finalized. Issue found using a prototype static analysis tool and confirmed by code review. (cherry picked from commit 2802952e4a07306da6ebe813ff1acacc5691851a)
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Multiple Releases of Same Resource or Handle
The product attempts to close or release a resource or handle more than once, without any successful open between the close operations.
How developers prevent this class of flaw
- Change the code's logic so that the resource is only closed once. This might require simplifying or refactoring. This fix can be simple to do in small code blocks, but more difficult when multiple closes are buried within complex conditionals.
- It can be effective to implement a flag that is (1) set when the resource is opened, (2) cleared when it is closed, and (3) checked before closing. This approach can be useful when there are disparate cases in which closes must be performed. However, flag-tracking can increase code complexity and requires diligent compliance by the programmer.
- When closing a resource, set the resource's associated variable to NULL or equivalent value for the given language. Some APIs will ignore this null value without causing errors. For other APIs, this can lead to application crashes or exceptions, which may still be preferable to corrupting an unintended resource such as memory or data.
More Multiple Releases of Same Resource or Handle vulnerabilities (CWE-1341)
Timeline
- CVE record published.
- Record last changed materially (score, affected products, status or references).
References
Patches and release notes
Third-party and government advisories
- access.redhat.com/security/cve/CVE-2026-52987Third Party Advisory
- bugzilla.redhat.com/show_bug.cgi?id=2492365Issue Tracking, Third Party Advisory
- security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-52987.jsonThird Party Advisory
Recent Multiple Releases of Same Resource or Handle vulnerabilities
- 9.8 Critical severity
Spotted an error? Tell us.