{
    "dataType": "CVE_RECORD",
    "dataVersion": "5.2",
    "cveMetadata": {
        "cveId": "CVE-2026-68239",
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "state": "PUBLISHED",
        "assignerShortName": "Linux",
        "dateReserved": "2026-07-30T09:28:09.376Z",
        "datePublished": "2026-08-10T12:01:04.297Z",
        "dateUpdated": "2026-08-17T05:01:28.470Z"
    },
    "containers": {
        "cna": {
            "providerMetadata": {
                "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
                "shortName": "Linux",
                "dateUpdated": "2026-08-17T05:01:28.470Z"
            },
            "descriptions": [
                {
                    "lang": "en",
                    "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/ttm: Account for NULL and handle pages in ttm_pool_backup\n\nPages in ttm_pool_backup can be NULL or backup handles\n(ttm_backup_page_ptr_is_handle()), neither of which can be passed to\nset_pages_array_wb() or freed. Add a dedicated WB pass before the\ndma/purge loop that walks allocations using the same i += num_pages\nstride, skipping NULL and handle entries, and calls set_pages_array_wb()\nonce per contiguous run of real pages. Apply the same NULL/handle guard\nto the dma/purge loop.\n\nFixes the following oops:\n\nOops: general protection fault, kernel NULL pointer dereference 0x0: 0000 [#1] SMP NOPTI\nRIP: 0010:__cpa_process_fault+0xf8/0x770\nRSP: 0018:ffffc90000a87718 EFLAGS: 00010287\nRAX: 0000000000000000 RBX: ffffc90000a87868 RCX: 0000000000000000\nRDX: 0000000000001000 RSI: 0005088000000000 RDI: ffffffff827c5f34\nRBP: 0005088000000000 R08: ffffc90000a877cb R09: ffffc90000a877d0\nR10: 0000000000000000 R11: 000000000000001b R12: 000ffffffffff000\nR13: ffffc90000a87868 R14: ffffc90000a87868 R15: ffff88815b882ae0\nFS:  0000000000000000(0000) GS:ffff8884ec840000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007f930b844000 CR3: 000000000262e003 CR4: 0000000008f70ef0\nPKRU: 55555554\nCall Trace:\n <TASK>\n __change_page_attr_set_clr+0x989/0xe90\n ? __purge_vmap_area_lazy+0x6c/0x3a0\n ? _vm_unmap_aliases+0x250/0x2a0\n set_pages_array_wb+0x7f/0x120\n ttm_pool_backup+0x4c9/0x5b0 [ttm]\n ? dma_resv_wait_timeout+0x3b/0xf0\n ttm_tt_backup+0x32/0x60 [ttm]\n ttm_bo_shrink+0x66/0x110 [ttm]\n xe_bo_shrink_purge+0x12b/0x1b0 [xe]\n xe_bo_shrink+0xbb/0x270 [xe]\n __xe_shrinker_walk+0xf7/0x160 [xe]\n xe_shrinker_walk+0x9d/0xc0 [xe]\n xe_shrinker_scan+0x11f/0x210 [xe]\n do_shrink_slab+0x13b/0x270\n shrink_slab+0xf1/0x400\n shrink_node+0x352/0x8a0\n balance_pgdat+0x32c/0x700\n kswapd+0x205/0x2f0\n ? __pfx_autoremove_wake_function+0x10/0x10\n ? __pfx_kswapd+0x10/0x10\n kthread+0xd1/0x110\n ? __pfx_kthread+0x10/0x10\n ret_from_fork+0x1b1/0x200\n ? __pfx_kthread+0x10/0x10\n ret_from_fork_asm+0x1a/0x30\n </TASK>"
                }
            ],
            "affected": [
                {
                    "product": "Linux",
                    "vendor": "Linux",
                    "defaultStatus": "unaffected",
                    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                    "programFiles": [
                        "drivers/gpu/drm/ttm/ttm_pool.c"
                    ],
                    "versions": [
                        {
                            "version": "b63d715b8090aed48bdef5930625946fa4c0d324",
                            "lessThan": "22aa7fb4e7d0b3ab41d1240ed743167980912970",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "b63d715b8090aed48bdef5930625946fa4c0d324",
                            "lessThan": "9ddaabf38f7a45b329e34358b98d2968d8649d21",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "b63d715b8090aed48bdef5930625946fa4c0d324",
                            "lessThan": "5b7b3b6595ee77d01c7463757baed114786094dd",
                            "status": "affected",
                            "versionType": "git"
                        }
                    ]
                },
                {
                    "product": "Linux",
                    "vendor": "Linux",
                    "defaultStatus": "affected",
                    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                    "programFiles": [
                        "drivers/gpu/drm/ttm/ttm_pool.c"
                    ],
                    "versions": [
                        {
                            "version": "6.15",
                            "status": "affected"
                        },
                        {
                            "version": "0",
                            "lessThan": "6.15",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "6.18.42",
                            "lessThanOrEqual": "6.18.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "7.1.6",
                            "lessThanOrEqual": "7.1.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "7.2",
                            "lessThanOrEqual": "*",
                            "status": "unaffected",
                            "versionType": "original_commit_for_fix"
                        }
                    ]
                }
            ],
            "cpeApplicability": [
                {
                    "nodes": [
                        {
                            "operator": "OR",
                            "negate": false,
                            "cpeMatch": [
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "6.15",
                                    "versionEndExcluding": "6.18.42"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "6.15",
                                    "versionEndExcluding": "7.1.6"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "6.15",
                                    "versionEndExcluding": "7.2"
                                }
                            ]
                        }
                    ]
                }
            ],
            "references": [
                {
                    "url": "https://git.kernel.org/stable/c/22aa7fb4e7d0b3ab41d1240ed743167980912970"
                },
                {
                    "url": "https://git.kernel.org/stable/c/9ddaabf38f7a45b329e34358b98d2968d8649d21"
                },
                {
                    "url": "https://git.kernel.org/stable/c/5b7b3b6595ee77d01c7463757baed114786094dd"
                }
            ],
            "title": "drm/ttm: Account for NULL and handle pages in ttm_pool_backup",
            "x_generator": {
                "engine": "bippy-1.2.0"
            }
        }
    }
}