CVE-2026-52949
Description
In the Linux kernel, the following vulnerability has been resolved:
drm/ttm: Fix ttm_bo_shrink() infinite LRU walk on backup failure
Apply the same fix as b2ed01e7ad ("drm/ttm: Fix ttm_bo_swapout()
infinite LRU walk on swapout failure") to the ttm_bo_shrink() path.
Move del_bulk_move from before the backup to after success only,
using ttm_resource_del_bulk_move_unevictable() since the resource
is now unevictable once fully backed up.
Summary dbcve.org
The ttm_bo_shrink() function in the Linux kernel DRM/TTM subsystem has a race condition where del_bulk_move is called before the backup operation completes. If the backup fails, the buffer object remains in an inconsistent state, causing an infinite LRU walk. The fix reorders operations to call del_bulk_move only after successful backup using ttm_resource_del_bulk_move_unevictable(), since the resource becomes unevictable once fully backed up.
Mitigation
This is a kernel-level bug requiring a kernel patch. Users should apply the upstream kernel fix. No userspace mitigation is available; the vulnerability is addressed by updating to a kernel version containing the fix.