drm/ttm: stale restore state after a successful restore leaves shmem handles in the page array
Impact
ttm_pool_restore_and_alloc() can finish a restore successfully but never drops tt->restore. Later backup/restore flows then see a restore that looks already complete while shmem handles are still installed in tt->pages, and the pages get handed to the scatter-gather builder as if they were real pages - the reported trace crashes in sg_alloc_append_table_from_pages() by way of xe_tt_map_sg() during a Xe exec ioctl. TTM backup/restore is what backs GPU memory eviction and suspend on Xe and other TTM drivers, so on a busy node this is reached by ordinary memory pressure rather than by a crafted request. The immediate consequence in the record is a kernel oops on the submit path, which takes down every workload on that GPU.
Who can reach it
Local. Any tenant submitting GPU work through a TTM-backed driver (the trace is Xe's exec ioctl) on a node under enough memory pressure to evict and restore buffer objects. No elevated privilege.
What to do
Take the stable-kernel update that frees and clears tt->restore once ttm_pool_restore_commit() succeeds. TTM is in the kernel tree, so this is a kernel upgrade: drain GPU jobs and reboot the node. No userspace or daemon-level workaround; reducing memory pressure only makes the path rarer.
References
Related entries
- Linux kernel amdgpu: unvalidated plane degamma LUT size allows divide-by-zero or out-of-bounds readCVE-2026-89819 · Linux kernel amdgpu display (AMD_PLANE_DEGAMMA_LUT plane degamma LUT size)High
- Linux kernel DRM core: race between failed drm_dev_register() and an open ioctl frees device state in useCVE-2026-89823 · Linux kernel DRM core (drm_dev_register() error path vs. in-flight ioctl)High
- Linux kernel drm/xe: flat CCS storage published as usable VRAM, corrupting allocationsCVE-2026-90047 · Linux kernel drm/xe (flat CCS offset rounding)High
- Linux kernel amdgpu: off-by-one in MST HDCP per-connector arrays sized 31 instead of 32CVE-2026-90289 · Linux kernel amdgpu display (AMDGPU_DM_MAX_DISPLAY_COUNT, MST HDCP per-connector arrays)High
- Linux kernel amdgpu DM: CRTC reset leaves a dangling state pointer when allocation failsCVE-2026-93175 · Linux kernel amdgpu display (amdgpu_dm_crtc_reset_state)High
- Linux amdkfd: use-after-free race when two threads destroy the same compute queueCVE-2026-97429 · Linux kernel amdkfd (destroy_queue_cpsch)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.