UBUNTU-CVE-2024-26940

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Create debugfs ttmresourcemanager entry only if needed The driver creates /sys/kernel/debug/dri/0/mobttm even when the corresponding ttmresourcemanager is not allocated. This leads to a crash when trying to read from...

kernel: drm/ttm: fix bulk_move corruption when adding a entry

In the Linux kernel, the following vulnerability has been resolved: drm/ttm: fix bulkmove corruption when adding a entry When the resource is the first in the bulkmove range, adding it again thus moving it to the tail will corrupt the list since the first pointer is not moved. This eventually lea...

kernel: drm/ttm: check null pointer before accessing when swapping

In the Linux kernel, the following vulnerability has been resolved: drm/ttm: check null pointer before accessing when swapping Add a check to avoid null pointer dereference as below: 90.002283 general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 1 PREEMPT SMP KASA...

kernel: Kernel: Denial of Service via resource leak in drm/ttm

A flaw was found in the Linux kernel's Direct Rendering Manager DRM subsystem, specifically within the TTM Translation Table Manager component. A local attacker with low privileges could exploit this vulnerability due to a resource leak that occurs during certain eviction errors. This could lead ...

PT-2024-3618

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The issue is related to the function amdgpu ttm move in the Linux kernel, specifically with the drm/amdgpu module. The problem arises after moving data, where the old location becomes...

DEBIAN-CVE-2021-47200

In the Linux kernel, the following vulnerability has been resolved: drm/prime: Fix use after free in mmap with drmgemttmmmap drmgemttmmmap drops a reference to the gem object on success. If the gem object's refcount == 1 on entry to drmgemprimemmap, that drop will free the gem object, and the...

UBUNTU-CVE-2021-47142

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix a use-after-free looks like we forget to set ttm-sg to NULL. Hit panic below 1235.844104 general protection fault, probably for non-canonical address 0x6b6b6b6b6b6b7b4b: 0000 1 SMP DEBUGPAGEALLOC NOPTI 1235.989074...

CVE-2021-47142

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix a use-after-free looks like we forget to set ttm-sg to NULL. Hit panic below 1235.844104 general protection fault, probably for non-canonical address 0x6b6b6b6b6b6b7b4b: 0000 1 SMP DEBUGPAGEALLOC NOPTI 1235.989074...

CVE-2021-47142 drm/amdgpu: Fix a use-after-free

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix a use-after-free looks like we forget to set ttm-sg to NULL. Hit panic below 1235.844104 general protection fault, probably for non-canonical address 0x6b6b6b6b6b6b7b4b: 0000 1 SMP DEBUGPAGEALLOC NOPTI 1235.989074...

kernel: Linux kernel: Denial of Service and information disclosure via undefined bit shift in drm/ttm

A flaw was found in the Linux kernel's drm/ttm component. A local user could exploit an undefined behavior in bit shifting, specifically when a signed 32-bit value is shifted by 31 bits, which cannot be represented in an 'int' type. This vulnerability could lead to local information disclosure,...

kernel: drm/ttm: Fix a NULL pointer dereference

In the Linux kernel, the following vulnerability has been resolved: drm/ttm: Fix a NULL pointer dereference The LRU mechanism may look up a resource in the process of being removed from an object. The locking rules here are a bit unclear but it looks currently like res-bo assignment is protected ...

kernel: Linux kernel: Denial of Service and information disclosure via undefined bit shift in drm/ttm

A flaw was found in the Linux kernel's drm/ttm component. A local user could exploit an undefined behavior in bit shifting, specifically when a signed 32-bit value is shifted by 31 bits, which cannot be represented in an 'int' type. This vulnerability could lead to local information disclosure,...

kernel: drm/ttm: Fix dummy res NULL ptr deref bug

A flaw was found in the ttm module in the Linux kernel. A NULL pointer dereference can be triggered due to an improper check, resulting in a denial of service...

PT-2025-25963 · Linux +2 · Linux Kernel +2

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: A vulnerability in the Linux kernel has been resolved, related to the drm/i915/ttm component. The issue involves the potential leak of the CCS state from the previous user, which the...

PT-2025-25994 · Linux +3 · Linux Kernel +3

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: A null pointer dereference bug has been resolved in the Linux kernel. The issue occurred in the drm/ttm module, where the bo-resource value was not checked before accessing the mem typ...

SUSE CVE-2019-19927

In the Linux kernel 5.0.0-rc7 as distributed in ubuntu/linux.git on kernel.ubuntu.com, mounting a crafted f2fs filesystem image and performing some operations can lead to slab-out-of-bounds read access in ttmputpages in drivers/gpu/drm/ttm/ttmpagealloc.c. This is related to the vmwgfx or ttm modu...

GSD-2023-1000788 drm/ttm: fix undefined behavior in bit shift for TTM_TT_FLAG_PRIV_POPULATED

drm/ttm: fix undefined behavior in bit shift for TTMTTFLAGPRIVPOPULATED This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v6.0.16 by commit...

GSD-2023-1000429 drm/i915/ttm: consider CCS for backup objects

drm/i915/ttm: consider CCS for backup objects This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v6.0.18 by commit...

PT-2023-33506 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v6.0.18 Description: The issue concerns the drm/i915/ttm component, specifically regarding the consideration of CCS for backup objects. The actual impact and attack plausibility have not yet been proven...

PT-2025-41032

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw exists in the Linux kernel’s DRM/amdgpu subsystem related to size validation for non-exclusive domains. Specifically, the amdgpu bo validate size function did not properly check f...