Skip to main content

Linux Kernel EUVDEUVD-2026-38817

| CVE-2026-52949 MEDIUM
2026-06-24 Linux GHSA-wvcw-5xvm-q83m
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local low-privilege access required to trigger memory pressure path; no confidentiality or integrity impact, only kernel availability via infinite loop.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
5.5 LOW
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 22, 2026 - 20:56 vuln.today
CVSS changed
Jul 14, 2026 - 17:07 NVD
5.5 (MEDIUM)
Patch available
Jun 24, 2026 - 18:02 EUVD
CVE Published
Jun 24, 2026 - 16:28 nvd
MEDIUM 5.5
CVE Published
Jun 24, 2026 - 16:28 cve.org
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

drm/ttm: Fix ttm_bo_shrink() infinite LRU walk on backup failure

Apply the same fix as b2ed01e7ad ("drm/ttm: Fix ttm_bo_swapout() infinite LRU walk on swapout failure") to the ttm_bo_shrink() path.

Move del_bulk_move from before the backup to after success only, using ttm_resource_del_bulk_move_unevictable() since the resource is now unevictable once fully backed up.

AnalysisAI

Infinite LRU list traversal in the Linux kernel's drm/ttm memory management subsystem allows a local low-privileged user to cause a kernel hang or denial of service on GPU-equipped systems. The flaw resides in ttm_bo_shrink(), where the bulk-move removal step was executed before confirming successful buffer object backup, leaving the LRU list in a corrupted state that loops indefinitely on backup failure. Notably, the 'Information Disclosure' tag in source intelligence conflicts with the CVSS C:N metric - the actual impact is availability only. No public exploit code has been identified, and EPSS exploitation probability is very low at 0.16% (6th percentile).

Technical ContextAI

TTM (Translation Table Maps) is the GPU buffer object memory manager used by the Linux DRM (Direct Rendering Manager) subsystem, relied upon by drivers such as amdgpu, nouveau, and i915. When system memory pressure occurs, ttm_bo_shrink() is invoked to back up GPU buffer objects to system RAM. The bug is a logic ordering error: ttm_resource_del_bulk_move_unevictable() (which removes a buffer object from bulk move tracking and marks it unevictable) was called before the backup succeeded. On backup failure, this leaves the LRU list in an inconsistent state, causing the kernel to loop indefinitely over it. This mirrors an identical defect fixed in ttm_bo_swapout() by upstream commit b2ed01e7ad. The CPE data (cpe:2.3:a:linux:linux) covers the Linux kernel broadly; affected kernel versions include 6.15 and stable branches between commit 70d645deac98303d1bf9ab08a4e68da52bf8c1e1 and the respective fix commits. No CWE is formally assigned, but the root cause aligns with CWE-835 (Loop with Unreachable Exit Condition) arising from a state management defect.

RemediationAI

The upstream fix consists of two stable-branch commits available at https://git.kernel.org/stable/c/9402ad98a047dd9894ec868a7df5ad9bd03327d3 and https://git.kernel.org/stable/c/1d59f36e95f7f7134db0e313c9d787cb0adb2153. Users should upgrade to Linux kernel 7.1 or 7.0.10 where the fix is incorporated per EUVD version data. Ubuntu users should apply the packages distributed under USN-8568-1 and USN-8566-1 via standard package management (apt-get upgrade). If patching is not immediately feasible on GPU compute systems, reducing local user access to GPU resources (e.g., restricting /dev/dri device permissions to trusted users or groups) limits the practical attack surface, though this may impact GPU workloads. There is no known non-disruptive workaround that eliminates the vulnerability without restricting GPU access.

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0 Not-Affected

Share

EUVD-2026-38817 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy