CVE-2026-52965: Linux Kernel TTM Swapout Loop Vulnerability

CVE-2026-52965 Overview

CVE-2026-52965 is a Linux kernel vulnerability in the Direct Rendering Manager (DRM) Translation Table Manager (TTM) subsystem. The flaw causes an infinite loop in ttm_bo_swapout() when ttm_tt_swapout() fails during buffer object swap operations. The bug stems from incorrect handling of the Least Recently Used (LRU) walk cursor after a failed swapout, where the resource is reinserted in front of the walk hitch and is then visited repeatedly.

The issue affects systems using the TTM memory manager, which is common on graphics drivers such as AMD, Nouveau, Radeon, and other DRM drivers that rely on TTM for video memory management.

Critical Impact
An infinite kernel loop in the DRM/TTM swapout path can cause CPU exhaustion and system hangs under memory pressure, leading to local denial of service on affected Linux systems.

Affected Products

Linux kernel branches containing the affected drm/ttm swapout logic prior to the fix
DRM drivers using TTM for buffer object management (for example AMDGPU, Radeon, Nouveau)
Linux distributions shipping the vulnerable kernel revisions until stable updates are applied

Discovery Timeline

2026-06-24 - CVE-2026-52965 published to NVD
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-52965

Vulnerability Analysis

The vulnerability lives in the TTM buffer object swapout path. When the kernel attempts to swap out a TTM buffer object and ttm_tt_swapout() returns a failure, the original code calls ttm_resource_add_bulk_move() followed by ttm_resource_move_to_lru_tail() to restore the resource's bulk_move membership.

ttm_resource_move_to_lru_tail() places the resource at the tail of the LRU list. The LRU walk cursor, however, holds a hitch node that was inserted immediately after the resource at the moment it was yielded. Moving the resource to the tail places it in front of the hitch.

The subsequent list_for_each_entry_continue() from the hitch encounters the same resource again. Each retry triggers another failed swapout, and the loop never advances, resulting in an unbounded kernel-mode walk.

Root Cause

The defect is an order violation between LRU list mutation and walk-cursor state. The failure path restored bulk_move tracking using a tail-insertion helper that did not account for the hitch position, so the cursor and the list state became inconsistent. The fix defers del_bulk_move to the success path. On success, TTM_TT_FLAG_SWAPPED has been set but the resource is still tracked in the bulk_move range, so the existing !ttm_resource_unevictable() guard in ttm_resource_del_bulk_move() would skip removal. The patch introduces ttm_resource_del_bulk_move_unevictable() to bypass that guard and remove the resource correctly.

Attack Vector

Triggering the bug requires local activity that produces memory pressure on TTM-managed buffer objects and induces ttm_tt_swapout() failures. A local unprivileged user with access to a DRM device node can exercise allocation and eviction paths through graphics or compute workloads. Exploitation does not yield code execution or privilege escalation; it manifests as a kernel CPU soft lockup or hang. See the upstream commits 0124a09e3e5f and b2ed01e7ad3d for the implementation of the fix.

Detection Methods for CVE-2026-52965

Indicators of Compromise

Kernel soft lockup or RCU stall messages referencing ttm_bo_swapout, ttm_resource_move_to_lru_tail, or list_for_each_entry_continue in dmesg.
Sustained 100% CPU utilization in a kernel worker thread tied to a DRM driver under memory pressure.
Unresponsive graphics stack or compositor while the system continues to schedule other work intermittently.

Detection Strategies

Monitor kernel logs for repeated BUG: soft lockup or watchdog: BUG: soft lockup - CPU#x stuck entries with TTM symbols in the stack trace.
Compare running kernel versions against the fixed stable commits to identify hosts still exposed to the regression.
Track DRM driver versions distributed by the OS vendor and flag systems running pre-patch builds.

Monitoring Recommendations

Alert on sustained kernel CPU time anomalies on hosts with GPUs, especially under heavy graphics or compute workloads.
Capture and forward dmesg and /proc/sys/kernel/tainted state to a centralized log store for retrospective analysis.
Review crash dumps and kdump output for TTM-related stacks after unexplained reboots or hangs.

How to Mitigate CVE-2026-52965

Immediate Actions Required

Apply the stable kernel updates that include commits 0124a09e3e5f and b2ed01e7ad3d from your distribution.
Reboot affected hosts after the kernel package is upgraded so the new TTM logic takes effect.
Inventory systems running GPUs with DRM drivers that depend on TTM and prioritize their patching.

Patch Information

The upstream fix defers del_bulk_move to the success path of ttm_bo_swapout() and introduces ttm_resource_del_bulk_move_unevictable() to remove the resource even when the TTM_TT_FLAG_SWAPPED flag has been set. Reference the patches at kernel.org commit 0124a09e3e5f and kernel.org commit b2ed01e7ad3d. Use distribution-provided kernel updates rather than building from source where possible.

Workarounds

Reduce memory pressure on TTM-managed buffer objects by limiting concurrent GPU workloads on unpatched hosts.
Restrict access to DRM device nodes to trusted users until the patched kernel is deployed.
Where feasible, run sensitive workloads on hosts whose graphics drivers do not depend on the TTM swapout path.

bash

# Verify the running kernel and confirm the patched commit is present
uname -r

# Debian/Ubuntu: install the latest kernel and reboot
sudo apt update && sudo apt install --only-upgrade linux-image-$(uname -r | sed 's/.*-//')
sudo reboot

# RHEL/Fedora: update the kernel package and reboot
sudo dnf update kernel
sudo reboot

# After reboot, watch for TTM-related soft lockups
sudo dmesg -T | grep -iE 'ttm|soft lockup|rcu'