CVE-2026-68239

In the Linux kernel, the following vulnerability has been resolved:

drm/ttm: Account for NULL and handle pages in ttm_pool_backup

Pages in ttm_pool_backup can be NULL or backup handles

(ttm_backup_page_ptr_is_handle()), neither of which can be passed to

set_pages_array_wb() or freed. Add a dedicated WB pass before the

dma/purge loop that walks allocations using the same i += num_pages

stride, skipping NULL and handle entries, and calls set_pages_array_wb()

once per contiguous run of real pages. Apply the same NULL/handle guard

to the dma/purge loop.

Fixes the following oops:

Oops: general protection fault, kernel NULL pointer dereference 0x0: 0000 [#1] SMP NOPTI

RIP: 0010:__cpa_process_fault+0xf8/0x770

RSP: 0018:ffffc90000a87718 EFLAGS: 00010287

RAX: 0000000000000000 RBX: ffffc90000a87868 RCX: 0000000000000000

RDX: 0000000000001000 RSI: 0005088000000000 RDI: ffffffff827c5f34

RBP: 0005088000000000 R08: ffffc90000a877cb R09: ffffc90000a877d0

R10: 0000000000000000 R11: 000000000000001b R12: 000ffffffffff000

R13: ffffc90000a87868 R14: ffffc90000a87868 R15: ffff88815b882ae0

FS: 0000000000000000(0000) GS:ffff8884ec840000(0000) knlGS:0000000000000000

CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033

CR2: 00007f930b844000 CR3: 000000000262e003 CR4: 0000000008f70ef0

PKRU: 55555554

Call Trace:

<TASK>

__change_page_attr_set_clr+0x989/0xe90

? __purge_vmap_area_lazy+0x6c/0x3a0

? _vm_unmap_aliases+0x250/0x2a0

set_pages_array_wb+0x7f/0x120

ttm_pool_backup+0x4c9/0x5b0 [ttm]

? dma_resv_wait_timeout+0x3b/0xf0

ttm_tt_backup+0x32/0x60 [ttm]

ttm_bo_shrink+0x66/0x110 [ttm]

xe_bo_shrink_purge+0x12b/0x1b0 [xe]

xe_bo_shrink+0xbb/0x270 [xe]

__xe_shrinker_walk+0xf7/0x160 [xe]

xe_shrinker_walk+0x9d/0xc0 [xe]

xe_shrinker_scan+0x11f/0x210 [xe]

do_shrink_slab+0x13b/0x270

shrink_slab+0xf1/0x400

shrink_node+0x352/0x8a0

balance_pgdat+0x32c/0x700

kswapd+0x205/0x2f0

? __pfx_autoremove_wake_function+0x10/0x10

? __pfx_kswapd+0x10/0x10

kthread+0xd1/0x110

? __pfx_kthread+0x10/0x10

ret_from_fork+0x1b1/0x200

? __pfx_kthread+0x10/0x10

ret_from_fork_asm+0x1a/0x30

</TASK>