Executive brief
A vulnerability in the Linux kernel's graphics memory management system (TTM) can cause the system to enter an infinite loop. This occurs when the system attempts to move memory to disk (swapout) and fails, leading to a hang that impacts system availability. This could be used by a local attacker to cause a denial-of-service condition, crashing or freezing the operating system.
Technical details
A vulnerability in the Linux kernel DRM TTM (Translation Table Manager) subsystem arises from improper LRU (Least Recently Used) list management during swapout failures. When ttm_tt_swapout() fails, the code attempts to restore the resource's bulk_move membership by calling ttm_resource_move_to_lru_tail(). This action places the resource at the tail of the LRU list, which, due to the positioning of the walk cursor's hitch node, causes the next iteration of list_for_each_entry_continue() to re-encounter the same resource. This results in an infinite loop within the kernel. The fix involves deferring the bulk_move deletion to the success path and introducing a specialized removal function that bypasses unevictable guards.
Affected products
- Linux Linux 6.13
Timeline
- 2026-06-24: disclosed
- 2026-06-24: advisory