CVE-2026-98166

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

drm/ttm: fix swapped-out resources never leaving their bulk_move range

ttm_tt_swapout() returns the number of pages swapped out on success and

a negative error code on failure; for a populated ttm it never returns

zero. Commit b2ed01e7ad3d ("drm/ttm: Fix ttm_bo_swapout() infinite LRU

walk on swapout failure") moved the bulk_move bookkeeping in

ttm_bo_swapout_cb() under "if (!ret)", so the

ttm_resource_del_bulk_move_unevictable() / ttm_resource_move_to_lru_tail()

pair is now skipped on every successful swapout. The equivalent change

for the shrinker in commit 1d59f36e95f7 ("drm/ttm: Fix ttm_bo_shrink()

infinite LRU walk on backup failure") tests "lret > 0", which is what

was intended here as well.

Before b2ed01e7ad3d the resource was taken off the bulk_move before the

swapout; since then a swapped-out resource stays inside its BO's

bulk_move range (and on the manager LRU) although it is unevictable.

When it is later

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References