CVE-2026-68239 in Linux
Summary
by MITRE • 08/10/2026
In the Linux kernel, the following vulnerability has been resolved:
drm/ttm: Account for NULL and handle pages in ttm_pool_backup
Pages in ttm_pool_backup can be NULL or backup handles (ttm_backup_page_ptr_is_handle()), neither of which can be passed to set_pages_array_wb() or freed. Add a dedicated WB pass before the dma/purge loop that walks allocations using the same i += num_pages stride, skipping NULL and handle entries, and calls set_pages_array_wb() once per contiguous run of real pages. Apply the same NULL/handle guard to the dma/purge loop.
Fixes the following oops:
Oops: general protection fault, kernel NULL pointer dereference 0x0: 0000 [#1] SMP NOPTI
RIP: 0010:__cpa_process_fault+0xf8/0x770 RSP: 0018:ffffc90000a87718 EFLAGS: 00010287 RAX: 0000000000000000 RBX: ffffc90000a87868 RCX: 0000000000000000 RDX: 0000000000001000 RSI: 0005088000000000 RDI: ffffffff827c5f34 RBP: 0005088000000000 R08: ffffc90000a877cb R09: ffffc90000a877d0 R10: 0000000000000000 R11: 000000000000001b R12: 000ffffffffff000 R13: ffffc90000a87868 R14: ffffc90000a87868 R15: ffff88815b882ae0 FS: 0000000000000000(0000) GS:ffff8884ec840000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f930b844000 CR3: 000000000262e003 CR4: 0000000008f70ef0 PKRU: 55555554 Call Trace: <TASK> __change_page_attr_set_clr+0x989/0xe90 ? __purge_vmap_area_lazy+0x6c/0x3a0 ? _vm_unmap_aliases+0x250/0x2a0 set_pages_array_wb+0x7f/0x120 ttm_pool_backup+0x4c9/0x5b0 [ttm]
? dma_resv_wait_timeout+0x3b/0xf0 ttm_tt_backup+0x32/0x60 [ttm]
ttm_bo_shrink+0x66/0x110 [ttm]
xe_bo_shrink_purge+0x12b/0x1b0 [xe]
xe_bo_shrink+0xbb/0x270 [xe]
__xe_shrinker_walk+0xf7/0x160 [xe]
xe_shrinker_walk+0x9d/0xc0 [xe]
xe_shrinker_scan+0x11f/0x210 [xe]
do_shrink_slab+0x13b/0x270 shrink_slab+0xf1/0x400 shrink_node+0x352/0x8a0 balance_pgdat+0x32c/0x700 kswapd+0x205/0x2f0 ? __pfx_autoremove_wake_function+0x10/0x10 ? __pfx_kswapd+0x10/0x10 kthread+0xd1/0x110 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x1b1/0x200 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 </TASK>
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/10/2026
The vulnerability resides within the drm/ttm subsystem of the Linux kernel, specifically in the ttm_pool_backup function where improper handling of NULL and backup handle pages leads to a kernel NULL pointer dereference. This flaw occurs during memory management operations involving graphics buffer objects and their associated page pools. The issue manifests when the kernel attempts to process pages that have not been properly initialized or are marked as backup handles, which cannot be passed directly to set_pages_array_wb() or freed without proper validation.
The technical root cause involves a lack of proper null pointer checks and handle type verification before page processing operations. When ttm_pool_backup iterates through allocated pages using a stride-based approach, it fails to account for entries that are either NULL pointers or backup handle references. These invalid entries bypass normal processing paths and eventually lead to kernel crashes when the system attempts to call set_pages_array_wb() on them. The oops trace shows the fault occurring in __cpa_process_fault during page attribute changes, with the call stack clearly indicating the path through ttm_pool_backup to set_pages_array_wb where the actual crash occurs.
This vulnerability directly relates to CWE-476 which addresses NULL pointer dereferences, and aligns with ATT&CK technique T1059.003 for kernel-mode rootkits and privilege escalation vectors. The operational impact is significant as it can cause system crashes and potential denial of service conditions, particularly in graphics-intensive environments where ttm (tiling translation manager) is actively managing buffer objects. Systems utilizing Intel graphics drivers such as xe (Xe graphics engine) are especially vulnerable since the crash path includes xe_bo_shrink_purge and related functions that trigger the faulty code path.
The fix implements a dedicated write-back pass before the DMA/purge loop, ensuring that only valid page entries are processed in contiguous runs. This approach maintains the same i += num_pages stride pattern but incorporates explicit checks for NULL and handle entries, skipping invalid pages while grouping real pages for efficient processing. The solution also applies the same guard logic to the DMA/purge loop itself, preventing both phases from attempting operations on invalid page references. This defensive programming approach eliminates the kernel crash by ensuring proper validation before any page manipulation occurs.
The fix addresses the fundamental flaw in memory management within the graphics subsystem where improper state handling leads to kernel panics. By introducing explicit null and handle validation checks before critical operations, the patch prevents the system from attempting to perform write-back operations on invalid page references while maintaining the integrity of legitimate page processing workflows. This remediation follows secure coding practices recommended by the Linux kernel security team and aligns with industry standards for preventing kernel-level memory corruption vulnerabilities. The solution maintains backward compatibility while ensuring robust handling of edge cases in graphics buffer management scenarios.