Linux Kernel EUVD-2026-38833

TTM (Translation Table Manager) is the GPU video memory management layer within the Linux DRM (Direct Rendering Manager) framework, used by drivers such as amdgpu, nouveau, and vmwgfx. The vulnerability resides in ttm_bo_swapout(), the function responsible for evicting GPU buffer objects to system swap under memory pressure. The root cause is CWE-835 (Loop with Unreachable Exit Condition): when TTM swapout fails, ttm_resource_add_bulk_move() and ttm_resource_move_to_lru_tail() are called to restore bulk_move membership, but placing the resource at the LRU tail puts it directly in front of the hitch node that anchors the current walk cursor - making it the next item found by list_for_each_entry_continue() on every subsequent iteration. The fix defers del_bulk_move to the success path only and introduces ttm_resource_del_bulk_move_unevictable() to bypass an incorrect !ttm_resource_unevictable() guard that would otherwise skip removal after TTM_TT_FLAG_SWAPPED is set. CPE data confirms the affected product as cpe:2.3:a:linux:linux across the vulnerable commit range.