Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-89815— drm/ttm: Drop tt->restore after successful restore

Quick assessment

Affected

Linux Linux

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Linux 内核中，已解决以下漏洞： drm/ttm：在恢复成功后丢弃 tt->restore 能够通过成功完成恢复过程，但在之后并未清除（drop）指针。这导致后续的备份/恢复流程观察到的是一个“看似已完成”的恢复状态，而实际上中仍然安装着 shmem 句柄，从而导致了下方所示的调用栈跟踪。修复方法：在中，当恢复成功完成后，释放并清除。以下是崩溃时的内核调用栈跟踪信息：

CVSS 7.8 · High EPSS 0.17% · P6 Updated Sep 23, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 8

Vendor	Product	Version Range	Status
Linux	Linux	`b63d715b8090aed48bdef5930625946fa4c0d324< 329ddc5d438f991f49e4fd24c704d1c7288d5e03`	affected
		`b63d715b8090aed48bdef5930625946fa4c0d324< a46ab76b6cf5478e2ac7b942a377c7a1827b436a`	affected
		`b63d715b8090aed48bdef5930625946fa4c0d324< 941ac10529b3be5965a88d432a161ab459672ba8`	affected
		`6.15`	affected
		`< 6.15`	unaffected
		`6.18.53≤ 6.18.*`	unaffected
		`7.2.5≤ 7.2.*`	unaffected
		`7.3-rc1≤ *`	unaffected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

drm/ttm: Drop tt->restore after successful restore

Source: CVE Program / CVE List V5

Vulnerability Description

In the Linux kernel, the following vulnerability has been resolved: drm/ttm: Drop tt->restore after successful restore ttm_pool_restore_and_alloc() can successfully complete the restore process via ttm_pool_restore_commit(), but tt->restore is not dropped afterward. As a result, subsequent backup/restore flows observe what appears to be a completed restore, while in reality shmem handles are still installed in tt->pages, leading to the stack trace below. Fix this by freeing and dropping tt->restore in ttm_pool_restore_and_alloc() upon successful completion of the restore. 20545 [ 309.784531] RIP: 0010:sg_alloc_append_table_from_pages+0x38c/0x490 20547 [ 309.809570] RSP: 0018:ffffc9000623b838 EFLAGS: 00010206 20548 [ 309.814827] RAX: 0000000000001000 RBX: ffff88816e42a160 RCX: 0000000000000000 20549 [ 309.821986] RDX: 0000000000002000 RSI: 0000000000000003 RDI: 0000000000001000 20550 [ 309.829147] RBP: ffff88816e42a168 R08: 0000000000000002 R09: 000000007ffff000 20551 [ 309.836310] R10: ffffc9000623b928 R11: 0000000000000000 R12: 000000007ffff000 20552 [ 309.843471] R13: ffff88815ba5a100 R14: 0000000000000000 R15: 0000000000000001 20553 [ 309.850634] FS: 00007f9ff305e700(0000) GS:ffff888276c94000(0000) knlGS:0000000000000000 20554 [ 309.858749] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 20555 [ 309.864519] CR2: 00007f9fca701000 CR3: 00000001565e2005 CR4: 0000000008f70ef0 20556 [ 309.871678] PKRU: 55555558 20557 [ 309.874403] Call Trace: 20558 [ 309.876866] <TASK> 20559 [ 309.878988] sg_alloc_table_from_pages_segment+0x60/0x100 20560 [ 309.884415] ? ttm_resource_manager_usage+0x36/0x60 [ttm] 20561 [ 309.889845] ? xe_tt_map_sg+0x7d/0xd0 [xe] 20562 [ 309.894045] xe_tt_map_sg+0x7d/0xd0 [xe] 20563 [ 309.898037] xe_bo_move+0x927/0xaa0 [xe] 20564 [ 309.902029] ttm_bo_handle_move_mem+0xba/0x170 [ttm] 20565 [ 309.907022] ttm_bo_validate+0xbe/0x190 [ttm] 20566 [ 309.911405] xe_bo_validate+0x9a/0x120 [xe] 20567 [ 309.915663] xe_gpuvm_validate+0xd9/0x140 [xe] 20568 [ 309.920206] drm_gpuvm_validate+0x2f0/0x5b0 [drm_gpuvm] 20569 [ 309.925459] ? drm_exec_lock_obj+0x63/0x210 [drm_exec] 20570 [ 309.930627] xe_vm_validate_rebind+0x46/0xb0 [xe] 20571 [ 309.935428] xe_exec_fn+0x20/0x40 [xe] 20572 [ 309.939249] drm_gpuvm_exec_lock+0x78/0xc0 [drm_gpuvm] 20573 [ 309.944410] xe_validation_exec_lock+0x5a/0xa0 [xe] 20574 [ 309.949385] xe_exec_ioctl+0x806/0xc30 [xe] 20575 [ 309.953639] ? ttwu_queue_wakelist+0xd9/0xf0 20576 [ 309.957935] ? __pfx_xe_exec_fn+0x10/0x10 [xe] 20577 [ 309.962449] ? __wake_up_common+0x73/0xa0 20578 [ 309.966482] ? __pfx_xe_exec_ioctl+0x10/0x10 [xe] 20579 [ 309.971263] drm_ioctl_kernel+0xa3/0x100 20580 [ 309.975209] drm_ioctl+0x213/0x440 20581 [ 309.978637] ? __pfx_xe_exec_ioctl+0x10/0x10 [xe] 20582 [ 309.983415] xe_drm_ioctl+0x67/0xd0 [xe] 20583 [ 309.987408] __x64_sys_ioctl+0x7f/0xd0

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

N/A

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Linux	Linux	b63d715b8090aed48bdef5930625946fa4c0d324 ~ 329ddc5d438f991f49e4fd24c704d1c7288d5e03	-
Linux	Linux	6.15	-

II. Public POCs for CVE-2026-89815

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-89815

请登录查看更多情报信息。

Other References for CVE-2026-89815 (3)

https://www.cve.org/CVERecord?id=CVE-2026-89815

Same Patch Batch · Linux · 2026-09-16 · 276 CVEs total

CVE-2026-90048	9.8 CRITICAL	fs/ntfs3: fix slab-out-of-bounds write in ni_create_attr_list()
CVE-2026-90012	9.8 CRITICAL	spi: Fix DMA mapping ownership on partial map failure
CVE-2026-89970	9.8 CRITICAL	nvmet-auth: Synchronize timeout work during SQ teardown
CVE-2026-89857	9.8 CRITICAL	scsi: qla2xxx: Hold qpair lock when sending NVMe LS reject
CVE-2026-89969	9.8 CRITICAL	nvmet-tcp: fix out-of-bounds write when receiving an over-long PDU
CVE-2026-89847	9.8 CRITICAL	scsi: qla2xxx: Avoid double completion in async IOCB timeout
CVE-2026-89972	9.8 CRITICAL	nvme: add missing SRCU grace period in error path
CVE-2026-89990	9.8 CRITICAL	ceph: lock mutex in ceph_mds_check_access()
CVE-2026-90036	9.8 CRITICAL	NFSD: Prevent client use-after-free during blocked-lock reaping
CVE-2026-90038	9.8 CRITICAL	NFSD: Prevent client use-after-free during export state revocation
CVE-2026-90037	9.8 CRITICAL	NFSD: Prevent client use-after-free during close_lru reaping
CVE-2026-89788	9.8 CRITICAL	ksmbd: fix tree connection use-after-free in smb2_tree_connect()
CVE-2026-89783	9.8 CRITICAL	xfrm6: fix out-of-bounds write in xfrm6_input_addr() when secpath is full
CVE-2026-90042	9.8 CRITICAL	ceph: properly decrypt filenames in vmalloc() buffers
CVE-2026-89778	9.8 CRITICAL	isofs: fix out-of-bounds page array access on empty zisofs block
CVE-2026-89915	9.3 CRITICAL	KVM: arm64: Remove VM-wide VNCR mapping counter
CVE-2026-90049	9.3 CRITICAL	net: skbuff: don't skb_tx_error() the source skb in skb_zerocopy()
CVE-2026-89775	9.3 CRITICAL	KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation
CVE-2026-89916	9.3 CRITICAL	KVM: arm64: Make VNCR invalidation participate in MMU invalidation retry
CVE-2026-89930	9.3 CRITICAL	KVM: nVMX: Service local TLB flushes on failed nested VM-Enter

Showing top 20 of 276 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same product: Linux

Same vendor: Linux

V. Comments for CVE-2026-89815

No comments yet

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-89815— drm/ttm: Drop tt->restore after successful restore

Quick assessment

Possible ATT&CK Techniques 1 AI

Affected Version Matrix 8

I. Basic Information for CVE-2026-89815

Vulnerability Information

Vulnerability Title

Vulnerability Description

CVSS Information

Vulnerability Type

Affected Products

II. Public POCs for CVE-2026-89815

III. Intelligence Information for CVE-2026-89815

Other References for CVE-2026-89815 (3)

Same Patch Batch · Linux · 2026-09-16 · 276 CVEs total

IV. Related Vulnerabilities

V. Comments for CVE-2026-89815

Leave a comment