drm/ttm: Fix ttm_bo_swapout() infinite LRU walk on swapout failure
In the Linux kernel, the following vulnerability has been resolved: drm/ttm: Fix ttm_bo_swapout() infinite LRU walk on swapout failure When ttm_tt_swapout() fails, the current code calls ttm_resource_add_bulk_move() followed by ttm_resource_move_to_lru_tail() to restore the resource's bulk_move membership. However, ttm_resource_move_to_lru_tail() places the resource at the tail of the LRU list which, relative to the walk cursor's hitch node (placed immediately after the resource when it was yielded), puts the resource *in front of the* the hitch. The next list_for_each_entry_continue() from the hitch finds the same resource again, causing an infinite loop. Fix by deferring del_bulk_move to the success path only. On the success path, TTM_TT_FLAG_SWAPPED has just been set by ttm_tt_swapout() but the resource is still tracked in the bulk_move range, so ttm_resource_del_bulk_move()'s !ttm_resource_unevictable() guard would incorrectly skip the removal. Introduce ttm_resource_del_bulk_move_unevictable() which bypasses that guard.
CVE-2026-52965
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-52965
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "fc5d96670eb2540d2572a14351e82ffe45d5ac11",
"lessThan": "060f8f3020516d71bc4d6159d4d0beef85606a74",
"versionType": "git"
},
{
"status": "affected",
"version": "fc5d96670eb2540d2572a14351e82ffe45d5ac11",
"lessThan": "0124a09e3e5f5f6080efe9663b27af27933f8382",
"versionType": "git"
},
{
"status": "affected",
"version": "fc5d96670eb2540d2572a14351e82ffe45d5ac11",
"lessThan": "b2ed01e7ad3de80333e9b962a44024b094bc0b2b",
"versionType": "git"
}
],
"programFiles": [
"drivers/gpu/drm/ttm/ttm_bo.c",
"drivers/gpu/drm/ttm/ttm_resource.c",
"include/drm/ttm/ttm_resource.h"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "6.13"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "6.13",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver",
"lessThanOrEqual": "7.0.*"
},
{
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"drivers/gpu/drm/ttm/ttm_bo.c",
"drivers/gpu/drm/ttm/ttm_resource.c",
"include/drm/ttm/ttm_resource.h"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2026-52965
Source reference:
/cveMetadata/cveId
Publisher severity
No explicit severity was provided.
- Event
- #28609 · Revision 1
- Added to Heist Feed
- Publisher date