CVE-2026-52965: Linux Kernel DRM/TTM LRU Infinite Loop Denial of Service

Technical summary

CVE-2026-52965 addresses a logic error in the TTM (Translation Table Maps) buffer object swap-out mechanism within the Linux DRM subsystem. Specifically, when ttm_tt_swapout() fails during a memory reclamation operation, the error handling path calls ttm_resource_add_bulk_move() followed by ttm_resource_move_to_lru_tail(). The latter function repositions the resource at the LRU (Least Recently Used) list tail, which places it in front of the walk cursor's hitch node—the bookmark used to resume iteration. Consequently, the next list_for_each_entry_continue() invocation re-discovers the same resource, creating an infinite loop. The patch defers bulk_move deletion to the success path and introduces ttm_resource_del_bulk_move_unevictable() to properly handle resources marked TTM_TT_FLAG_SWAPPED while still enrolled in bulk_move tracking.

Business impact

An attacker with local system access could trigger this bug through graphics operations or memory pressure scenarios, causing a denial of service via kernel hang or crash. Systems relying on GPU acceleration for workloads—rendering, compute, or AI/ML tasks—would experience service disruption. For organizations running graphics-intensive applications or virtual desktop infrastructure with GPU passthrough, this vulnerability could impact availability and user productivity. The attack requires local privilege (CWE-835: infinite loop vulnerability) but does not enable data theft or system compromise.

Affected systems

The Linux kernel's DRM/TTM subsystem is affected across all maintained branches that include the vulnerable code path. This impacts systems with GPU hardware that use the open-source DRM stack: AMD GPUs (via amdgpu), NVIDIA GPUs (via nouveau), Intel GPUs (via i915), and other DRM-dependent accelerators. The vulnerability does not affect systems without GPU or graphics acceleration, nor does it affect Windows, macOS, or other non-Linux kernels. Verify your specific kernel version and configuration against the upstream Linux kernel advisory for exact affected versions.

Exploitability

Exploitability is moderate. The vulnerability requires local code execution with unprivileged user privileges (PR:L per CVSS vector), meaning an authenticated local attacker can trigger the bug. It is not remotely exploitable. The bug is triggered through graphics subsystem calls or memory reclamation under certain conditions, making it non-trivial to exploit reliably but feasible for an attacker with shell access. No public exploit code is known at this time, and the vulnerability is not listed on the CISA KEV catalog, indicating it is not yet under active exploitation in the wild.

Remediation

Apply the latest stable Linux kernel patch that includes the fix for ttm_bo_swapout() error handling. This involves updating to a patched kernel version—verify the specific version numbers through your Linux distribution's security advisories or upstream kernel.org. For enterprises managing kernel deployments, coordinate patching with your standard change management process, prioritizing systems with GPU workloads or graphics-intensive applications. Interim mitigation is limited; restricting local user access reduces attack surface but does not eliminate the vulnerability in existing code.

Patch guidance

Obtain the fix from your Linux distribution's security updates (Red Hat, Debian, Ubuntu, SUSE, etc.) or directly from kernel.org. The patch modifies ttm_bo_swapout() to defer ttm_resource_del_bulk_move() calls to the success path only and introduces ttm_resource_del_bulk_move_unevictable() helper function. Test the patched kernel in a non-production environment first, especially if you run GPU-accelerated workloads, to ensure driver stability and performance. Kernel patches typically require a system reboot to take effect.

Detection guidance

Monitor system logs for repeated kernel warnings or BUG messages related to DRM/TTM or LRU list operations. Check for kernel panics or hangs coinciding with graphics operations or memory pressure events. On affected systems, dmesg logs may show TTM-related stack traces or deadlock warnings. If you have instrumentation in place (e.g., kprobes, eBPF), track calls to ttm_bo_swapout() that result in memory page-out failures followed by LRU re-traversal. Network-based detection is not feasible; focus on host-level observation during graphics workload execution or memory reclamation cycles.

Why prioritize this

Prioritize this patch for systems running GPU workloads or using graphics acceleration in production. Although the CVSS score is medium (5.5) and exploitability requires local access, the impact (denial of service via infinite loop) can render graphics-dependent services unavailable. Organizations running virtual desktop infrastructure, GPU compute clusters, rendering farms, or AI/ML inference platforms should treat this as high priority. For general-purpose servers without GPU, this is lower priority but should still be included in regular kernel maintenance cycles.

Risk score, explained

CVSS 3.1 score of 5.5 (MEDIUM) reflects: local attack vector (AV:L), low complexity (AC:L), low privilege requirement (PR:L), no user interaction (UI:N), unchanged scope (S:U), no confidentiality or integrity impact (C:N/I:N), and high availability impact (A:H). The score appropriately reflects the denial-of-service nature of the bug—it causes system hang or crash but does not leak data or enable privilege escalation. The absence from the CISA KEV catalog indicates it is not yet prioritized as a critical active threat but should not be dismissed given its reliable trigger conditions under GPU memory pressure.

Frequently asked questions