CVE-2026-52949: Linux Kernel TTM LRU Walk Vulnerability

CVE-2026-52949 Overview

CVE-2026-52949 affects the Linux kernel's Direct Rendering Manager Translation Table Manager (drm/ttm) subsystem. The flaw resides in the ttm_bo_shrink() function, which can enter an infinite Least Recently Used (LRU) walk when a buffer object backup operation fails. The kernel maintainers resolved the issue by applying the same pattern previously used in commit b2ed01e7ad for ttm_bo_swapout(). The fix relocates the del_bulk_move call to execute only after a successful backup, using ttm_resource_del_bulk_move_unevictable() because the resource becomes unevictable once fully backed up.

Critical Impact
A failed backup operation in the TTM shrinker path can trap the kernel in an infinite LRU traversal, leading to a denial-of-service condition on systems using affected DRM graphics drivers.

Affected Products

Linux kernel versions containing the unpatched ttm_bo_shrink() implementation in drm/ttm
Systems using DRM graphics drivers that rely on the TTM memory manager (e.g., AMDGPU, Radeon, Nouveau, Xe, i915 variants)
Distributions shipping kernels prior to the stable patches referenced in the upstream commits

Discovery Timeline

2026-06-24 - CVE-2026-52949 published to NVD
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-52949

Vulnerability Analysis

The Translation Table Manager (TTM) is the Linux kernel memory manager used by DRM drivers to handle Graphics Processing Unit (GPU) buffer objects. The ttm_bo_shrink() function participates in memory reclaim by walking the LRU list of buffer objects and attempting to back them up to secondary storage when system memory pressure increases.

In the unpatched code, the del_bulk_move operation was performed before the backup attempt. When the backup failed, the buffer object remained on the LRU list in a state that caused the shrinker to re-encounter the same object on every iteration. This produced an infinite loop in the reclaim path, stalling memory pressure handling and consuming CPU cycles.

The fix mirrors a prior correction applied to ttm_bo_swapout() in commit b2ed01e7ad. The patch moves del_bulk_move to execute only after the backup succeeds, and switches to ttm_resource_del_bulk_move_unevictable() because the resource transitions to an unevictable state once fully backed up. This prevents the shrinker from re-selecting an unbacked object.

Root Cause

The root cause is incorrect ordering of LRU list manipulation relative to a fallible I/O operation. The shrinker removed bulk-move tracking before confirming backup success, leaving the buffer in a state where failure paths did not advance the LRU iterator, producing an infinite loop.

Attack Vector

The NVD entry does not assign an attack vector or CVSS score for this issue. Triggering the condition requires inducing backup failures during TTM shrinker activity, which generally occurs under memory pressure. Local workloads that stress GPU memory allocation while constraining system memory could reach the affected code path.

The Linux kernel commits 1d59f36e95f7f7134db0e313c9d787cb0adb2153 and 9402ad98a047dd9894ec868a7df5ad9bd03327d3 contain the upstream resolution. See the Kernel Git Commit Details and Kernel Git Commit Update for the patch contents.

Detection Methods for CVE-2026-52949

Indicators of Compromise

Kernel soft-lockup or RCU stall warnings referencing ttm_bo_shrink in stack traces
Sustained 100% CPU utilization in kernel-mode threads handling memory reclaim under GPU memory pressure
System hangs or unresponsiveness on hosts running DRM drivers when swap or backup storage encounters errors

Detection Strategies

Audit running kernel versions across Linux fleets and compare against patched stable releases referenced in the upstream commits
Collect dmesg and journal output for ttm_bo_shrink references in soft-lockup, hung-task, or watchdog warnings
Monitor perf or ftrace samples for excessive time spent in TTM shrinker functions during memory pressure events

Monitoring Recommendations

Track kernel package versions through configuration management and flag hosts lacking the fix commits 1d59f36e95f7 and 9402ad98a047
Alert on repeated kernel soft-lockup messages or khugepaged/shrinker thread CPU spikes on GPU-equipped servers
Correlate backup or swap subsystem I/O errors with subsequent shrinker activity in centralized log collection

How to Mitigate CVE-2026-52949

Immediate Actions Required

Apply the upstream stable kernel updates containing commits 1d59f36e95f7f7134db0e313c9d787cb0adb2153 and 9402ad98a047dd9894ec868a7df5ad9bd03327d3
Update affected systems through the distribution package manager once vendor-backported kernels become available
Schedule reboots on hosts running DRM/TTM workloads to load the patched kernel

Patch Information

The vulnerability is resolved upstream in the Linux kernel. The fix moves del_bulk_move to run only after a successful backup and uses ttm_resource_del_bulk_move_unevictable() to reflect the buffer's post-backup state. Refer to the Kernel Git Commit Details and Kernel Git Commit Update for the authoritative patch.

Workarounds

Reduce GPU memory pressure by limiting concurrent graphics workloads on affected hosts until a patched kernel is deployed
Ensure backup or swap storage backing TTM operations is healthy and not returning I/O errors, since the infinite loop is triggered by backup failure
Reboot the affected host to recover service if a soft-lockup occurs in ttm_bo_shrink before patching is possible

bash

# Verify the running kernel contains the fix commits
uname -r
git -C /usr/src/linux log --oneline | grep -E "1d59f36e95f7|9402ad98a047"

# Check dmesg for shrinker-related soft lockups
dmesg -T | grep -iE "ttm_bo_shrink|soft lockup|rcu_sched"