CVE-2026-98166

A flaw was found in the Linux kernel's DRM TTM Direct Rendering Manager Translation Table Manager subsystem. Due to an improper status check during memory swapout operations, swapped-out buffer resources are not properly untracked, leaving stale pointers referencing freed memory. A local user cou...

DEBIAN-CVE-2026-98166

In the Linux kernel, the following vulnerability has been resolved: drm/ttm: fix swapped-out resources never leaving their bulkmove range ttmttswapout returns the number of pages swapped out on success and a negative error code on failure; for a populated ttm it never returns zero. Commit...

CVE-2026-98166

In the Linux kernel, the following vulnerability has been resolved: drm/ttm: fix swapped-out resources never leaving their bulkmove range ttmttswapout returns the number of pages swapped out on success and a negative error code on failure; for a populated ttm it never returns zero. Commit...

CVE-2026-98166

In the Linux kernel, the following vulnerability has been resolved: drm/ttm: fix swapped-out resources never leaving their bulkmove range ttmttswapout returns the number of pages swapped out on success and a negative error code on failure; for a populated ttm it never returns zero. Commit...

UBUNTU-CVE-2026-98166

In the Linux kernel, the following vulnerability has been resolved: drm/ttm: fix swapped-out resources never leaving their bulkmove range ttmttswapout returns the number of pages swapped out on success and a negative error code on failure; for a populated ttm it never returns zero. Commit...

CVE-2026-98166 drm/ttm: fix swapped-out resources never leaving their bulk_move range

In the Linux kernel, the following vulnerability has been resolved: drm/ttm: fix swapped-out resources never leaving their bulkmove range ttmttswapout returns the number of pages swapped out on success and a negative error code on failure; for a populated ttm it never returns zero. Commit...

EUVD-2026-93094

In the Linux kernel, the following vulnerability has been resolved: drm/ttm: fix swapped-out resources never leaving their bulkmove range ttmttswapout returns the number of pages swapped out on success and a negative error code on failure; for a populated ttm it never returns zero. Commit...

CVE-2026-98166

A flaw in the Linux kernel 's DRM TTM (Direct Rendering Manager Translation Table Manager) subsystem allows swapped-out buffer resources to remain in their bulk_move range due to an improper status check. This oversight causes range endpoints to point at freed memory when resources are later free...

CVE-2026-98166

In the Linux kernel, the following vulnerability has been resolved: drm/ttm: fix swapped-out resources never leaving their bulkmove range ttmttswapout returns the number of pages swapped out on success and a negative error code on failure; for a populated ttm it never returns zero. Commit...

CVE-2026-98166 drm/ttm: fix swapped-out resources never leaving their bulk_move range

In the Linux kernel, the following vulnerability has been resolved: drm/ttm: fix swapped-out resources never leaving their bulkmove range ttmttswapout returns the number of pages swapped out on success and a negative error code on failure; for a populated ttm it never returns zero. Commit...

PT-2026-106495

Name of the Vulnerable Software and Affected Versions Linux kernel versions 7.0.y Description An issue exists in the drm/ttm component where swapped-out resources fail to leave their bulk move range. This occurs because the bookkeeping logic in ttm bo swapout cb incorrectly skips the ttm resource...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: drm/ttm: Do not leak a resource on eviction error. For eviction errors other than -EMULTIHOP, we were leaking a resource. This issue has been fixed. v2: - Avoid using another “goto” statement. Andi Shyti...

SUSE CVE-2026-89815

In the Linux kernel, the following vulnerability has been resolved: drm/ttm: Drop tt-restore after successful restore ttmpoolrestoreandalloc can successfully complete the restore process via ttmpoolrestorecommit, but tt-restore is not dropped afterward. As a result, subsequent backup/restore flow...

CVE-2026-89815

In the Linux kernel, the following vulnerability has been resolved: drm/ttm: Drop tt-restore after successful restore ttmpoolrestoreandalloc can successfully complete the restore process via ttmpoolrestorecommit, but tt-restore is not dropped afterward. As a result, subsequent backup/restore flow...

DEBIAN-CVE-2026-89815

In the Linux kernel, the following vulnerability has been resolved: drm/ttm: Drop tt-restore after successful restore ttmpoolrestoreandalloc can successfully complete the restore process via ttmpoolrestorecommit, but tt-restore is not dropped afterward. As a result, subsequent backup/restore flow...

CVE-2026-89815

CVE-2026-89815 affects the Linux kernel in the drm/ttm (Translation Table Manager) subsystem, specifically triggered via the Intel Xe GPU driver 's execution buffer path. The root cause is that ttm_pool_restore_and_alloc() fails to free and drop tt->restore after a successful restore commit, l...

CVE-2026-89815 drm/ttm: Drop tt->restore after successful restore

In the Linux kernel, the following vulnerability has been resolved: drm/ttm: Drop tt-restore after successful restore ttmpoolrestoreandalloc can successfully complete the restore process via ttmpoolrestorecommit, but tt-restore is not dropped afterward. As a result, subsequent backup/restore flow...

EUVD-2026-80415

In the Linux kernel, the following vulnerability has been resolved: drm/ttm: Drop tt-restore after successful restore ttmpoolrestoreandalloc can successfully complete the restore process via ttmpoolrestorecommit, but tt-restore is not dropped afterward. As a result, subsequent backup/restore flow...

CVE-2026-89815 drm/ttm: Drop tt->restore after successful restore

In the Linux kernel, the following vulnerability has been resolved: drm/ttm: Drop tt-restore after successful restore ttmpoolrestoreandalloc can successfully complete the restore process via ttmpoolrestorecommit, but tt-restore is not dropped afterward. As a result, subsequent backup/restore flow...

PT-2026-93456

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the drm/ttm component where the ttm pool restore and alloc function fails to drop tt-restore after a successful restore process completed via ttm pool restore commit...