CVE-2026-52949: Linux Kernel DRM TTM Buffer Shrink Infinite Loop DoS

Technical summary

CVE-2026-52949 addresses a logic error in ttm_bo_shrink() within the DRM (Direct Rendering Manager) TTM (Translation Table Maps) subsystem. The vulnerability mirrors an earlier issue fixed in ttm_bo_swapout() (commit b2ed01e7ad). The problem occurs when del_bulk_move is called before attempting a resource backup operation. If the backup fails, the resource remains in an inconsistent state—marked as deleted from the bulk move list but still present in memory management structures. This causes subsequent LRU (Least Recently Used) walks to loop infinitely as they encounter orphaned resources. The patch moves the del_bulk_move call to execute only after successful backup completion, and uses ttm_resource_del_bulk_move_unevictable() to properly mark fully backed-up resources as unevictable.

Business impact

This vulnerability can cause kernel hangs and denial of service on systems using graphics hardware managed by the DRM TTM subsystem. Affected workloads include GPU-accelerated computing, virtualization hosts with GPU passthrough, and systems running intensive graphics applications. A local unprivileged user can trigger the infinite loop by exhausting system memory or triggering specific memory pressure conditions, resulting in system unresponsiveness and requiring a reboot to recover.

Affected systems

The vulnerability affects all versions of the Linux kernel with the affected TTM code path. Systems with dedicated GPUs (NVIDIA, AMD, Intel) managed through the DRM subsystem are most directly impacted, including desktop workstations, data center GPUs, and virtualization hosts. The issue is particularly relevant for environments where GPU memory is over-subscribed or where memory pressure is frequently triggered.

Exploitability

Exploitation requires local access with unprivileged user privileges. An attacker needs to trigger memory pressure conditions that cause the kernel to invoke ttm_bo_shrink() during backup operations. This is feasible in multi-tenant environments, shared systems, and scenarios where untrusted local code execution is possible. Remote exploitation is not possible. The attack surface is moderate; while it requires local access, the triggering conditions (memory exhaustion) are relatively straightforward to create.

Remediation

Apply the kernel patch that corrects the ttm_bo_shrink() function. The fix involves two key changes: (1) deferring the del_bulk_move operation until after successful backup completion, and (2) using ttm_resource_del_bulk_move_unevictable() to properly transition backed-up resources to unevictable state. Verify the patch against your kernel source tree and apply it as part of your kernel update process.

Patch guidance

This vulnerability is patched in Linux kernel versions that include the TTM fix for ttm_bo_shrink(). Check the kernel release notes and security advisories from your Linux distribution for the specific patched version. Systems should upgrade to a patched kernel version through their standard package management system. For enterprises, coordinate kernel updates with your change management process, keeping in mind that kernel updates typically require system restart. Test patches in a non-production environment first, particularly on systems heavily utilizing GPU resources.

Detection guidance

Monitor system logs for kernel warnings related to TTM buffer objects and memory pressure events. Watch for system hangs or unresponsiveness that correlate with GPU memory exhaustion. Performance monitoring tools can track GPU memory usage spikes and kernel softlockup warnings. During incident response, examine kernel logs (dmesg) for TTM-related errors and RCU stall warnings, which may indicate the infinite loop condition. Systems running vulnerable kernels under memory pressure will show characteristic hangs in the DRM/TTM subsystem.

Why prioritize this

While the CVSS score is moderate (5.5), this vulnerability should be prioritized for environments heavily dependent on GPU acceleration or running in memory-constrained settings. The impact—system hang requiring reboot—is severe for availability-critical workloads. Prioritize patching in virtualization hosts with GPU assignment, high-performance computing clusters, and rendering farms. Standard office and lightweight workloads face lower risk unless they operate consistently under memory pressure.

Risk score, explained

The CVSS 3.1 score of 5.5 (MEDIUM) reflects a local attack vector requiring user privileges, with high impact on availability but no impact on confidentiality or integrity. The score appropriately captures that exploitation requires local access and specific conditions, but the consequence—denial of service via kernel hang—is significant for affected systems.

Frequently asked questions