CVE-2026-89815: Linux Kernel DRM/TTM Privilege Escalation

CVE-2026-89815 Overview

CVE-2026-89815 is a Linux kernel vulnerability in the Direct Rendering Manager Translation Table Manager (drm/ttm) subsystem. The flaw resides in ttm_pool_restore_and_alloc(), which fails to drop the tt->restore pointer after a successful restore operation via ttm_pool_restore_commit(). Subsequent backup and restore flows misinterpret the state, treating shmem handles still installed in tt->pages as valid pages. The result is memory state corruption that triggers kernel stack traces in sg_alloc_append_table_from_pages during GPU buffer object validation.

Critical Impact
A local authenticated user can trigger kernel-side memory state inconsistency in the drm/ttm subsystem, leading to potential denial of service and compromise of kernel integrity through the Xe graphics driver ioctl path.

Affected Products

Linux kernel drm/ttm subsystem prior to the upstream fix
Linux kernel builds using the Intel Xe (xe) graphics driver
Distributions shipping affected drm_gpuvm and ttm modules

Discovery Timeline

2026-09-16 - CVE-2026-89815 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-89815

Vulnerability Analysis

The vulnerability sits inside the Translation Table Manager (TTM), which manages GPU-visible memory buffers in the Linux DRM stack. The function ttm_pool_restore_and_alloc() orchestrates the restoration of pages backed by shmem handles into a TTM object. When ttm_pool_restore_commit() completes successfully, the tt->restore pointer should be released to indicate the object has fully transitioned back to an allocated state.

The defective code path leaves tt->restore intact. Later backup or restore paths inspect tt->restore and conclude the restore completed cleanly. However, the pages array tt->pages still contains shmem handles rather than real page pointers. When downstream code such as xe_tt_map_sg() calls sg_alloc_append_table_from_pages() to build a scatter-gather table, it dereferences these stale handles as if they were struct page pointers, producing the kernel oops shown in the reported stack trace.

This is a state-tracking defect that manifests as an Uninitialized Memory Use condition. The flaw is reachable through the xe_exec_ioctl path from userspace, meaning any process able to open the Xe DRM device node can trigger it.

Root Cause

The root cause is missing cleanup logic. ttm_pool_restore_and_alloc() does not free and null out tt->restore after ttm_pool_restore_commit() returns success. Ownership semantics of the restore descriptor are therefore ambiguous, and subsequent code paths make incorrect assumptions about the contents of tt->pages. The upstream fix drops tt->restore on successful completion of the restore.

Attack Vector

Exploitation requires local access with permission to open the DRM device and issue DRM_IOCTL calls to the Xe driver. An attacker triggers repeated buffer backup and restore cycles on a TTM-managed buffer object. Following a successful restore, they invoke an operation that walks tt->pages through xe_tt_map_sg(). The stale shmem handles are then processed as page pointers, corrupting scatter-gather table construction. See the Linux Kernel Commit Notice and Linux Kernel Commit Update for the corrective patches.

// See upstream commits for the corrective patch:
// - 941ac10529b3be5965a88d432a161ab459672ba8
// - a46ab76b6cf5478e2ac7b942a377c7a1827b436a
// No verified public exploit code is available.

Detection Methods for CVE-2026-89815

Indicators of Compromise

Kernel oops or warning entries referencing sg_alloc_append_table_from_pages, xe_tt_map_sg, or ttm_bo_handle_move_mem in dmesg and /var/log/kern.log.
Repeated xe_exec_ioctl failures followed by process termination on hosts using the Xe graphics driver.
Unexpected GPU buffer validation errors reported by DRM/GPUVM subsystems.

Detection Strategies

Monitor kernel ring buffer output for the signature call chain: sg_alloc_append_table_from_pages -> xe_tt_map_sg -> xe_bo_move -> ttm_bo_validate.
Track running kernel versions against distribution advisories referencing the two upstream drm/ttm fix commits.
Correlate DRM ioctl activity with kernel fault events on workstations and servers with Intel Xe-capable GPUs.

Monitoring Recommendations

Ingest kernel logs into a centralized logging platform and alert on TTM and DRM panic patterns.
Baseline expected xe driver ioctl volumes per host and flag anomalous spikes from non-graphics workloads.
Track kernel package versions across the fleet to identify hosts still exposed to CVE-2026-89815.

How to Mitigate CVE-2026-89815

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in commits 941ac10529b3be5965a88d432a161ab459672ba8 and a46ab76b6cf5478e2ac7b942a377c7a1827b436a.
Update to distribution kernel packages that incorporate the drm/ttm: Drop tt->restore after successful restore fix.
Restrict access to DRM device nodes such as /dev/dri/renderD* to trusted users and service accounts.

Patch Information

The fix modifies ttm_pool_restore_and_alloc() to free and drop tt->restore immediately after ttm_pool_restore_commit() succeeds. This ensures that subsequent backup and restore operations observe correct state and that tt->pages no longer contains stale shmem handles. The patches are available in the stable kernel tree via the Linux Kernel Commit Notice and the Linux Kernel Commit Update.

Workarounds

Disable or unload the xe kernel module on systems that do not require Intel Xe GPU acceleration.
Tighten permissions on /dev/dri/ device nodes and remove non-essential users from the video and render groups.
Avoid running untrusted local workloads on hosts with vulnerable drm/ttm kernels until patches are applied.

bash

# Verify installed kernel and DRM module status
uname -r
lsmod | grep -E 'ttm|xe|drm_gpuvm'

# Restrict access to DRM render nodes
sudo chmod 660 /dev/dri/renderD*
sudo chown root:render /dev/dri/renderD*

# Optionally blacklist the xe driver where not required
echo 'blacklist xe' | sudo tee /etc/modprobe.d/blacklist-xe.conf
sudo update-initramfs -u