143 lines
7.9 KiB
JSON
143 lines
7.9 KiB
JSON
{
|
|
"dataType": "CVE_RECORD",
|
|
"dataVersion": "5.2",
|
|
"cveMetadata": {
|
|
"cveId": "CVE-2026-68239",
|
|
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"state": "PUBLISHED",
|
|
"assignerShortName": "Linux",
|
|
"dateReserved": "2026-07-30T09:28:09.376Z",
|
|
"datePublished": "2026-08-10T12:01:04.297Z",
|
|
"dateUpdated": "2026-08-17T05:01:28.470Z"
|
|
},
|
|
"containers": {
|
|
"cna": {
|
|
"providerMetadata": {
|
|
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"shortName": "Linux",
|
|
"dateUpdated": "2026-08-17T05:01:28.470Z"
|
|
},
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/ttm: Account for NULL and handle pages in ttm_pool_backup\n\nPages in ttm_pool_backup can be NULL or backup handles\n(ttm_backup_page_ptr_is_handle()), neither of which can be passed to\nset_pages_array_wb() or freed. Add a dedicated WB pass before the\ndma/purge loop that walks allocations using the same i += num_pages\nstride, skipping NULL and handle entries, and calls set_pages_array_wb()\nonce per contiguous run of real pages. Apply the same NULL/handle guard\nto the dma/purge loop.\n\nFixes the following oops:\n\nOops: general protection fault, kernel NULL pointer dereference 0x0: 0000 [#1] SMP NOPTI\nRIP: 0010:__cpa_process_fault+0xf8/0x770\nRSP: 0018:ffffc90000a87718 EFLAGS: 00010287\nRAX: 0000000000000000 RBX: ffffc90000a87868 RCX: 0000000000000000\nRDX: 0000000000001000 RSI: 0005088000000000 RDI: ffffffff827c5f34\nRBP: 0005088000000000 R08: ffffc90000a877cb R09: ffffc90000a877d0\nR10: 0000000000000000 R11: 000000000000001b R12: 000ffffffffff000\nR13: ffffc90000a87868 R14: ffffc90000a87868 R15: ffff88815b882ae0\nFS: 0000000000000000(0000) GS:ffff8884ec840000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007f930b844000 CR3: 000000000262e003 CR4: 0000000008f70ef0\nPKRU: 55555554\nCall Trace:\n <TASK>\n __change_page_attr_set_clr+0x989/0xe90\n ? __purge_vmap_area_lazy+0x6c/0x3a0\n ? _vm_unmap_aliases+0x250/0x2a0\n set_pages_array_wb+0x7f/0x120\n ttm_pool_backup+0x4c9/0x5b0 [ttm]\n ? dma_resv_wait_timeout+0x3b/0xf0\n ttm_tt_backup+0x32/0x60 [ttm]\n ttm_bo_shrink+0x66/0x110 [ttm]\n xe_bo_shrink_purge+0x12b/0x1b0 [xe]\n xe_bo_shrink+0xbb/0x270 [xe]\n __xe_shrinker_walk+0xf7/0x160 [xe]\n xe_shrinker_walk+0x9d/0xc0 [xe]\n xe_shrinker_scan+0x11f/0x210 [xe]\n do_shrink_slab+0x13b/0x270\n shrink_slab+0xf1/0x400\n shrink_node+0x352/0x8a0\n balance_pgdat+0x32c/0x700\n kswapd+0x205/0x2f0\n ? __pfx_autoremove_wake_function+0x10/0x10\n ? __pfx_kswapd+0x10/0x10\n kthread+0xd1/0x110\n ? __pfx_kthread+0x10/0x10\n ret_from_fork+0x1b1/0x200\n ? __pfx_kthread+0x10/0x10\n ret_from_fork_asm+0x1a/0x30\n </TASK>"
|
|
}
|
|
],
|
|
"affected": [
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "unaffected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"drivers/gpu/drm/ttm/ttm_pool.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "b63d715b8090aed48bdef5930625946fa4c0d324",
|
|
"lessThan": "22aa7fb4e7d0b3ab41d1240ed743167980912970",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "b63d715b8090aed48bdef5930625946fa4c0d324",
|
|
"lessThan": "9ddaabf38f7a45b329e34358b98d2968d8649d21",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "b63d715b8090aed48bdef5930625946fa4c0d324",
|
|
"lessThan": "5b7b3b6595ee77d01c7463757baed114786094dd",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "affected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"drivers/gpu/drm/ttm/ttm_pool.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "6.15",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "0",
|
|
"lessThan": "6.15",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.18.42",
|
|
"lessThanOrEqual": "6.18.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "7.1.6",
|
|
"lessThanOrEqual": "7.1.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "7.2",
|
|
"lessThanOrEqual": "*",
|
|
"status": "unaffected",
|
|
"versionType": "original_commit_for_fix"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"cpeApplicability": [
|
|
{
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "6.15",
|
|
"versionEndExcluding": "6.18.42"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "6.15",
|
|
"versionEndExcluding": "7.1.6"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "6.15",
|
|
"versionEndExcluding": "7.2"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/22aa7fb4e7d0b3ab41d1240ed743167980912970"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/9ddaabf38f7a45b329e34358b98d2968d8649d21"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/5b7b3b6595ee77d01c7463757baed114786094dd"
|
|
}
|
|
],
|
|
"title": "drm/ttm: Account for NULL and handle pages in ttm_pool_backup",
|
|
"x_generator": {
|
|
"engine": "bippy-1.2.0"
|
|
}
|
|
}
|
|
}
|
|
} |