CVE-2026-89815

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

drm/ttm: Drop tt->restore after successful restore

ttm_pool_restore_and_alloc() can successfully complete the restore

process via ttm_pool_restore_commit(), but tt->restore is not dropped

afterward. As a result, subsequent backup/restore flows observe what

appears to be a completed restore, while in reality shmem handles are

still installed in tt->pages, leading to the stack trace below.

Fix this by freeing and dropping tt->restore in

ttm_pool_restore_and_alloc() upon successful completion of the restore.

20545 [  309.784531] RIP: 0010:sg_alloc_append_table_from_pages+0x38c/0x490

20547 [  309.809570] RSP: 0018:ffffc9000623b838 EFLAGS: 00010206

20548 [  309.814827] RAX: 0000000000001000 RBX: ffff88816e42a160 RCX: 0000000000000000

20549 [  309.821986] RDX: 0000000000002000 RSI: 0000000000000003 RDI: 0000000000001000

20550 [  309.829147] RBP: ffff88816e42a168 R08: 0000000000000002 R09: 000000007ffff000

20551 [  309.83

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References