{"id":24502,"date":"2026-09-16T20:32:24","date_gmt":"2026-09-16T12:32:24","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-89815"},"modified":"2026-09-16T20:32:24","modified_gmt":"2026-09-16T12:32:24","slug":"cve-2026-89815","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-89815","title":{"rendered":"CVE-2026-89815 &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\ndrm\/ttm: Drop tt-&gt;res"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>drm\/ttm: Drop tt-&gt;restore after successful restore<\/p>\n<p>ttm_pool_restore_and_alloc() can successfully complete the restore<br \/>\nprocess via ttm_pool_restore_commit(), but tt-&gt;restore is not dropped<br \/>\nafterward. As a result, subsequent backup\/restore flows observe what<br \/>\nappears to be a completed restore, while in reality shmem handles are<br \/>\nstill installed in tt-&gt;pages, leading to the stack trace below.<\/p>\n<p>Fix this by freeing and dropping tt-&gt;restore in<br \/>\nttm_pool_restore_and_alloc() upon successful completion of the restore.<\/p>\n<p>20545 [\u00a0 309.784531] RIP: 0010:sg_alloc_append_table_from_pages+0x38c\/0x490<br \/>\n20547 [\u00a0 309.809570] RSP: 0018:ffffc9000623b838 EFLAGS: 00010206<br \/>\n20548 [\u00a0 309.814827] RAX: 0000000000001000 RBX: ffff88816e42a160 RCX: 0000000000000000<br \/>\n20549 [\u00a0 309.821986] RDX: 0000000000002000 RSI: 0000000000000003 RDI: 0000000000001000<br \/>\n20550 [\u00a0 309.829147] RBP: ffff88816e42a168 R08: 0000000000000002 R09: 000000007ffff000<br \/>\n20551 [\u00a0 309.836310] R10: ffffc9000623b928 R11: 0000000000000000 R12: 000000007ffff000<br \/>\n20552 [\u00a0 309.843471] R13: ffff88815ba5a100 R14: 0000000000000000 R15: 0000000000000001<br \/>\n20553 [\u00a0 309.850634] FS:\u00a0 00007f9ff305e700(0000) GS:ffff888276c94000(0000) knlGS:0000000000000000<br \/>\n20554 [\u00a0 309.858749] CS:\u00a0 0010 DS: 0000 ES: 0000 CR0: 0000000080050033<br \/>\n20555 [\u00a0 309.864519] CR2: 00007f9fca701000 CR3: 00000001565e2005 CR4: 0000000008f70ef0<br \/>\n20556 [\u00a0 309.871678] PKRU: 55555558<br \/>\n20557 [\u00a0 309.874403] Call Trace:<br \/>\n20558 [\u00a0 309.876866]\u00a0<br \/>\n20559 [\u00a0 309.878988]\u00a0 sg_alloc_table_from_pages_segment+0x60\/0x100<br \/>\n20560 [\u00a0 309.884415]\u00a0 ? ttm_resource_manager_usage+0x36\/0x60 [ttm]<br \/>\n20561 [\u00a0 309.889845]\u00a0 ? xe_tt_map_sg+0x7d\/0xd0 [xe]<br \/>\n20562 [\u00a0 309.894045]\u00a0 xe_tt_map_sg+0x7d\/0xd0 [xe]<br \/>\n20563 [\u00a0 309.898037]\u00a0 xe_bo_move+0x927\/0xaa0 [xe]<br \/>\n20564 [\u00a0 309.902029]\u00a0 ttm_bo_handle_move_mem+0xba\/0x170 [ttm]<br \/>\n20565 [\u00a0 309.907022]\u00a0 ttm_bo_validate+0xbe\/0x190 [ttm]<br \/>\n20566 [\u00a0 309.911405]\u00a0 xe_bo_validate+0x9a\/0x120 [xe]<br \/>\n20567 [\u00a0 309.915663]\u00a0 xe_gpuvm_validate+0xd9\/0x140 [xe]<br \/>\n20568 [\u00a0 309.920206]\u00a0 drm_gpuvm_validate+0x2f0\/0x5b0 [drm_gpuvm]<br \/>\n20569 [\u00a0 309.925459]\u00a0 ? drm_exec_lock_obj+0x63\/0x210 [drm_exec]<br \/>\n20570 [\u00a0 309.930627]\u00a0 xe_vm_validate_rebind+0x46\/0xb0 [xe]<br \/>\n20571 [\u00a0 309.935428]\u00a0 xe_exec_fn+0x20\/0x40 [xe]<br \/>\n20572 [\u00a0 309.939249]\u00a0 drm_gpuvm_exec_lock+0x78\/0xc0 [drm_gpuvm]<br \/>\n20573 [\u00a0 309.944410]\u00a0 xe_validation_exec_lock+0x5a\/0xa0 [xe]<br \/>\n20574 [\u00a0 309.949385]\u00a0 xe_exec_ioctl+0x806\/0xc30 [xe]<br \/>\n20575 [\u00a0 309.953639]\u00a0 ? ttwu_queue_wakelist+0xd9\/0xf0<br \/>\n20576 [\u00a0 309.957935]\u00a0 ? __pfx_xe_exec_fn+0x10\/0x10 [xe]<br \/>\n20577 [\u00a0 309.962449]\u00a0 ? __wake_up_common+0x73\/0xa0<br \/>\n20578 [\u00a0 309.966482]\u00a0 ? __pfx_xe_exec_ioctl+0x10\/0x10 [xe]<br \/>\n20579 [\u00a0 309.971263]\u00a0 drm_ioctl_kernel+0xa3\/0x100<br \/>\n20580 [\u00a0 309.975209]\u00a0 drm_ioctl+0x213\/0x440<br \/>\n20581 [\u00a0 309.978637]\u00a0 ? __pfx_xe_exec_ioctl+0x10\/0x10 [xe]<br \/>\n20582 [\u00a0 309.983415]\u00a0 xe_drm_ioctl+0x67\/0xd0 [xe]<br \/>\n20583 [\u00a0 309.987408]\u00a0 __x64_sys_ioctl+0x7f\/0xd0<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>drm\/ttm: Drop tt-&gt;restore after successful restore<\/p>\n<p>ttm_pool_restore_and_alloc() can successfully complete the restore<br \/>\nprocess via <\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-24502","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/24502","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=24502"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=24502"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=24502"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}