MEDIUM

CVE-2026-52949

Linux Linux Kernel 2026-06-24 CVSS v3.1
CVSS
5.5

Description

In the Linux kernel, the following vulnerability has been resolved:

drm/ttm: Fix ttm_bo_shrink() infinite LRU walk on backup failure

Apply the same fix as b2ed01e7ad ("drm/ttm: Fix ttm_bo_swapout()
infinite LRU walk on swapout failure") to the ttm_bo_shrink() path.

Move del_bulk_move from before the backup to after success only,
using ttm_resource_del_bulk_move_unevictable() since the resource
is now unevictable once fully backed up.

Summary dbcve.org

The ttm_bo_shrink() function in the Linux kernel DRM/TTM subsystem has a race condition where del_bulk_move is called before the backup operation completes. If the backup fails, the buffer object remains in an inconsistent state, causing an infinite LRU walk. The fix reorders operations to call del_bulk_move only after successful backup using ttm_resource_del_bulk_move_unevictable(), since the resource becomes unevictable once fully backed up.

Mitigation

This is a kernel-level bug requiring a kernel patch. Users should apply the upstream kernel fix. No userspace mitigation is available; the vulnerability is addressed by updating to a kernel version containing the fix.

Patch Commit

EPSS Score

0.11%
Probability of exploitation in next 30 days
1.6th percentile

References

View on dbcve.org
Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.
Back to CVE