Executive brief
The Linux kernel's graphics memory management subsystem (TTM) has a bug where shared memory handles remain incorrectly installed after a restore operation completes. This can lead to memory corruption and system crashes when subsequent graphics operations attempt to reallocate or move memory. The issue affects graphics driver stability on systems using affected kernel versions.
Technical details
The vulnerability is a memory resource management bug in the DRM TTM (Translation Table Maps) subsystem. After ttm_pool_restore_and_alloc() successfully completes a restore operation via ttm_pool_restore_commit(), the tt->restore data structure is not freed or dropped, leaving shmem handles in tt->pages. Subsequent backup/restore cycles then observe an inconsistent state, as the old handles are still present. This manifests as a kernel crash in sg_alloc_append_table_from_pages() when graphics operations attempt to map pages. The vulnerability is triggered through normal graphics workloads (xe_exec_ioctl) and requires no special privileges or authentication. A fix involves properly freeing and dropping tt->restore upon successful restore completion.
Affected products
- Linux Linux kernel <UNKNOWN>
Timeline
- 2026-09-16: disclosed