In the Linux kernel, the following vulnerability has been resolved:
drm/i915: Fix potential UAF in TTM object purge
TLDR: The bo->ttm object might be changed by calling ttm_bo_validate(), move casting it to an i915_tt object later to actually get the right pointer.
A user reported hitting the following bug under heavy use on DG2:
[26620.095550] Oops: general protection fault, probably for non-canonical address 0xa56b6b6b6b6b6b8b: 0000 1 SMP NOPTI [26620.095556] CPU: 2 UID: 0 PID: 631 Comm: Xorg Not tainted 6.18.8 #1 PREEMPT(lazy) [26620.095558] Hardware name: ASRock B850M Steel Legend WiFi/B850M Steel Legend WiFi, BIOS 3.50 09/18/2025 [26620.095559] RIP: 0010:i915_ttm_purge+0x84/0x100 [i915] [26620.095604] Code: 00 00 00 48 8d 54 24 10 48 89 e6 48 89 fb e8 83 aa ae ff 85 c0 75 6f 48 83 bb a8 01 00 00 00 74 2c 48 8b 45 78 48 85 c0 74 23 <48> 8b 78 20 48 c7 c2 ff ff ff ff 31 f6 e8 7a 73 e3 e0 48 8b 7d 78 [26620.095605] RSP: 0018:ffffc90005fd7430 EFLAGS: 00010282 [26620.095607] RAX: a56b6b6b6b6b6b6b RBX: ffff8881f46c3dc0 RCX: 0000000000000000 [26620.095608] RDX: 0000000000000000 RSI: 0000000000000246 RDI: 00000000ffffffff [26620.095609] RBP: ffff888289610f00 R08: 0000000000000001 R09: ffff88823b022000 [26620.095609] R10: ffff888103029b28 R11: ffff8881fc7f3800 R12: ffff88810b6150d0 [26620.095609] R13: ffff888289610f00 R14: 0000000000000000 R15: ffff8881f46c3dc0 [26620.095610] FS: 00007f1004d86900(0000) GS:ffff88901c858000(0000) knlGS:0000000000000000 [26620.095611] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [26620.095611] CR2: 00007f0fdf489000 CR3: 000000035b0c1000 CR4: 0000000000750ef0 [26620.095612] PKRU: 55555554 [26620.095612] Call Trace: [26620.095615] <TASK> [26620.095615] i915_ttm_move+0x2b9/0x420 [i915] [26620.095642] ? ttm_tt_init+0x65/0x80 [ttm] [26620.095644] ? i915_ttm_tt_create+0xc6/0x150 [i915] [26620.095667] ttm_bo_handle_move_mem+0xb6/0x160 [ttm] [26620.095669] ttm_bo_evict+0x100/0x150 [ttm] [26620.095671] ? preempt_count_add+0x64/0xa0 [26620.095673] ? _raw_spin_lock+0xe/0x30 [26620.095675] ? _raw_spin_unlock+0xd/0x30 [26620.095675] ? i915_gem_object_evictable+0xb7/0xd0 [i915] [26620.095704] ttm_bo_evict_cb+0x6e/0xd0 [ttm] [26620.095705] ttm_lru_walk_for_evict+0xa6/0x200 [ttm] [26620.095708] ttm_bo_alloc_resource+0x185/0x4f0 [ttm] [26620.095709] ? init_object+0x62/0xd0 [26620.095712] ttm_bo_validate+0x7a/0x180 [ttm] [26620.095713] ? _raw_spin_unlock_irqrestore+0x16/0x30 [26620.095714] __i915_ttm_get_pages+0xb0/0x170 [i915] [26620.095737] i915_ttm_get_pages+0x9f/0x150 [i915] [26620.095759] ? i915_gem_do_execbuffer+0xedc/0x2b40 [i915] [26620.095786] ? alloc_debug_processing+0xd0/0x100 [26620.095787] ? _raw_spin_unlock_irqrestore+0x16/0x30 [26620.095788] ? i915_vma_instance+0xa0/0x4e0 [i915] [26620.095822] __i915_gem_object_get_pages+0x2f/0x40 [i915] [26620.095848] i915_vma_pin_ww+0x706/0x980 [i915] [26620.095875] ? i915_gem_do_execbuffer+0xedc/0x2b40 [i915] [26620.095904] eb_validate_vmas+0x170/0xa00 [i915] [26620.095930] i915_gem_do_execbuffer+0x1201/0x2b40 [i915] [26620.095953] ? alloc_debug_processing+0xd0/0x100 [26620.095954] ? _raw_spin_unlock_irqrestore+0x16/0x30 [26620.095955] ? i915_gem_execbuffer2_ioctl+0xc9/0x240 [i915] [26620.095977] ? __wake_up_sync_key+0x32/0x50 [26620.095979] ? i915_gem_execbuffer2_ioctl+0xc9/0x240 [i915] [26620.096001] ? __slab_alloc.isra.0+0x67/0xc0 [26620.096003] i915_gem_execbuffer2_ioctl+0x11a/0x240 [i915]
Results from decode_stacktrace.sh pointed to dereference of a file pointer field of a i915 TTM page vector container associated with an object being purged on eviction. That path is taken when the object is marked as no longer needed.
Code analysis revealed a possibility of the i915 TTM page vector container being replaced with a new instance inside a function that purges content of the object, should it be still busy. That function is called, indirectly via a more general function that changes the object's placement and caching policy, ---truncated---
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade kernel-debuginfoUpgrade kernel-headersUpgrade kernel-livepatch-6.18.35-68.127Upgrade perf-debuginfoUpgrade perf6.12-debuginfoUpgrade perf6.18-debuginfoUpgrade kernel6.18-debuginfo-common-aarch64Upgrade kernel-livepatch-6.1.176-220.358Upgrade bpftool6.12-debuginfoUpgrade bpftool6.12Upgrade kernel6.12-debuginfo-common-aarch64Upgrade kernel6.12-modules-extra-commonUpgrade kernel-tools-develUpgrade kernel6.12Upgrade kernel6.18-headersUpgrade kernel-debuginfo-common-aarch64Upgrade python3-perf6.12Upgrade kernel6.18-debuginfoUpgrade kernel6.12-modules-extraUpgrade bpftool-debuginfoUpgrade perfUpgrade bpftool6.18-debuginfoUpgrade kernel6.12-debuginfo-common-x86_64Upgrade kernel-tools-debuginfoUpgrade kernel-modules-extraUpgrade kernel6.18-develUpgrade python3-perf-debuginfoUpgrade kernel6.18-modules-extraUpgrade kernelUpgrade kernel6.12-tools-develUpgrade kernel6.12-tools-debuginfoUpgrade python3-perf6.18-debuginfoUpgrade perf6.18Upgrade kernel-modules-extra-commonUpgrade kernel6.12-headersUpgrade bpftool6.18Upgrade kernel6.18-toolsUpgrade kernel6.12-toolsUpgrade kernel6.12-debuginfoUpgrade python3-perf6.18Upgrade kernel6.18-debuginfo-common-x86_64Upgrade kernel-toolsUpgrade kernel6.18-modules-extra-commonUpgrade kernel6.18-tools-debuginfoUpgrade kernel6.18-tools-develUpgrade perf6.12Upgrade kernel6.18Upgrade kernel6.12-develUpgrade kernel-develUpgrade kernel-livepatch-6.12.94-123.174Upgrade python3-perf6.12-debuginfoUpgrade bpftoolUpgrade microvm-kernel6.18Upgrade python3-perfUpgrade kernel-debuginfo-common-x86_64 | Aug 10, 2026 | Jul 19, 2026 |
| Debian | — | Upgrade linux | Jul 20, 2026 | Jul 20, 2026 |
| Redhat_linux | — | Upgrade kernelNo solution existsUpgrade kernel-rt | Aug 4, 2026 | Jul 19, 2026 |
| Rocky_linux | — | Upgrade kernel-rt-debug-coreUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-rt-develUpgrade kernel-rt-debug-modulesUpgrade kernel-tools-libsUpgrade kernel-debuginfoUpgrade kernel-zfcpdump-debuginfoUpgrade kernel-debug-coreUpgrade kernel-rt-coreUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-modules-extraUpgrade kernel-rt-debug-develUpgrade kernel-rt-debug-modules-extraUpgrade kernel-debugUpgrade kernel-modulesUpgrade kernel-rt-debugUpgrade kernel-rt-debuginfo-common-x86_64Upgrade kernel-zfcpdump-develUpgrade perfUpgrade kernel-coreUpgrade kernelUpgrade bpftoolUpgrade kernel-uki-virtUpgrade kernel-develUpgrade rtlaUpgrade kernel-rt-debug-debuginfoUpgrade kernel-debug-uki-virtUpgrade kernel-rt-kvmUpgrade python3-perf-debuginfoUpgrade kernel-debug-develUpgrade kernel-tools-debuginfoUpgrade python3-perfUpgrade kernel-rt-debug-kvmUpgrade kernel-zfcpdump-modulesUpgrade kernel-debug-modules-extraUpgrade kernel-devel-matchedUpgrade kernel-uki-virt-addonsUpgrade kernel-rt-modules-extraUpgrade kernel-rt-debug-modules-coreUpgrade kernel-debug-modules-coreUpgrade bpftool-debuginfoUpgrade kernel-tools-libs-develUpgrade libperf-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-debuginfo-common-s390xUpgrade kernel-toolsUpgrade kernel-debug-debuginfoUpgrade kernel-debug-devel-matchedUpgrade kernel-rt-debuginfoUpgrade kernel-rt-modulesUpgrade kernel-zfcpdumpUpgrade kernel-rt-modules-coreUpgrade perf-debuginfoUpgrade kernel-rtUpgrade kernel-modules-coreUpgrade kernel-zfcpdump-coreUpgrade rvUpgrade libperfUpgrade kernel-debug-modulesUpgrade kernel-zfcpdump-modules-core | Aug 20, 2026 | Aug 18, 2026 |
| Ubuntu | — | Upgrade linux-image-oracle-64kUpgrade linux-image-7.0.0-1009-azure-fdeUpgrade linux-image-oracle-7.0Upgrade linux-image-7.0.0-1009-aws-64kUpgrade linux-image-nvidia-tegra-6.8Upgrade linux-image-7.0.0-1014-azureUpgrade linux-image-gcpUpgrade linux-image-awsUpgrade linux-image-raspi-7.0Upgrade linux-image-raspi-realtimeUpgrade linux-image-7.0.0-1011-oracleUpgrade linux-image-nvidia-tegra-rtUpgrade linux-image-azure-fde-7.0Upgrade linux-image-oracleUpgrade linux-image-oracle-64k-7.0Upgrade linux-image-aws-64kUpgrade linux-image-7.0.0-1011-gcpUpgrade linux-image-7.0.0-1015-raspi-realtimeUpgrade linux-image-gcp-7.0Upgrade linux-image-7.0.0-1009-awsUpgrade linux-image-7.0.0-1011-oracle-64kUpgrade linux-image-ibmUpgrade linux-image-nvidia-tegra-rt-6.8Upgrade linux-image-7.0.0-1016-nvidia-64kUpgrade linux-image-aws-7.0Upgrade linux-image-7.0.0-2016-nvidia-bos-64kUpgrade linux-image-raspiUpgrade linux-image-6.8.0-1036-nvidia-tegra-rtUpgrade linux-image-raspi-realtime-7.0Upgrade linux-image-nvidia-64k-hwe-26.04Upgrade linux-image-nvidiaUpgrade linux-image-aws-64k-7.0Upgrade linux-image-azure-7.0Upgrade linux-image-azure-fdeUpgrade linux-image-7.0.0-2016-nvidia-bosUpgrade linux-image-7.0.0-1016-nvidiaUpgrade linux-image-nvidia-tegraUpgrade linux-image-nvidia-64kUpgrade linux-image-ibm-7.0Upgrade linux-image-nvidia-64k-7.0Upgrade linux-image-7.0.0-1010-ibmUpgrade linux-image-7.0.0-1008-oracleUpgrade linux-image-nvidia-bos-7.0Upgrade linux-image-nvidia-bos-64kUpgrade linux-image-nvidia-7.0Upgrade linux-image-7.0.0-1011-gcp-64kUpgrade linux-image-7.0.0-1010-azureUpgrade linux-image-nvidia-bos-64k-7.0Upgrade linux-image-gcp-64k-7.0Upgrade linux-image-nvidia-hwe-26.04Upgrade linux-image-azureUpgrade linux-image-7.0.0-1008-oracle-64kUpgrade linux-image-gcp-64kUpgrade linux-image-nvidia-bosUpgrade linux-image-7.0.0-1015-raspiUpgrade linux-image-6.8.0-1036-nvidia-tegra | Jul 21, 2026 | Jul 20, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jul 27, 2026 | Jul 19, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub