GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-63884 (GCVE-0-2026-63884)

Vulnerability from cvelistv5 – Published: 2026-07-19 14:54 – Updated: 2026-08-05 12:36
VLAI
Title
drm/i915: Fix potential UAF in TTM object purge
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/i915: Fix potential UAF in TTM object purge TLDR: The bo->ttm object might be changed by calling ttm_bo_validate(), move casting it to an i915_tt object later to actually get the right pointer. A user reported hitting the following bug under heavy use on DG2: [26620.095550] Oops: general protection fault, probably for non-canonical address 0xa56b6b6b6b6b6b8b: 0000 1 SMP NOPTI [26620.095556] CPU: 2 UID: 0 PID: 631 Comm: Xorg Not tainted 6.18.8 #1 PREEMPT(lazy) [26620.095558] Hardware name: ASRock B850M Steel Legend WiFi/B850M Steel Legend WiFi, BIOS 3.50 09/18/2025 [26620.095559] RIP: 0010:i915_ttm_purge+0x84/0x100 [i915] [26620.095604] Code: 00 00 00 48 8d 54 24 10 48 89 e6 48 89 fb e8 83 aa ae ff 85 c0 75 6f 48 83 bb a8 01 00 00 00 74 2c 48 8b 45 78 48 85 c0 74 23 <48> 8b 78 20 48 c7 c2 ff ff ff ff 31 f6 e8 7a 73 e3 e0 48 8b 7d 78 [26620.095605] RSP: 0018:ffffc90005fd7430 EFLAGS: 00010282 [26620.095607] RAX: a56b6b6b6b6b6b6b RBX: ffff8881f46c3dc0 RCX: 0000000000000000 [26620.095608] RDX: 0000000000000000 RSI: 0000000000000246 RDI: 00000000ffffffff [26620.095609] RBP: ffff888289610f00 R08: 0000000000000001 R09: ffff88823b022000 [26620.095609] R10: ffff888103029b28 R11: ffff8881fc7f3800 R12: ffff88810b6150d0 [26620.095609] R13: ffff888289610f00 R14: 0000000000000000 R15: ffff8881f46c3dc0 [26620.095610] FS: 00007f1004d86900(0000) GS:ffff88901c858000(0000) knlGS:0000000000000000 [26620.095611] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [26620.095611] CR2: 00007f0fdf489000 CR3: 000000035b0c1000 CR4: 0000000000750ef0 [26620.095612] PKRU: 55555554 [26620.095612] Call Trace: [26620.095615] <TASK> [26620.095615] i915_ttm_move+0x2b9/0x420 [i915] [26620.095642] ? ttm_tt_init+0x65/0x80 [ttm] [26620.095644] ? i915_ttm_tt_create+0xc6/0x150 [i915] [26620.095667] ttm_bo_handle_move_mem+0xb6/0x160 [ttm] [26620.095669] ttm_bo_evict+0x100/0x150 [ttm] [26620.095671] ? preempt_count_add+0x64/0xa0 [26620.095673] ? _raw_spin_lock+0xe/0x30 [26620.095675] ? _raw_spin_unlock+0xd/0x30 [26620.095675] ? i915_gem_object_evictable+0xb7/0xd0 [i915] [26620.095704] ttm_bo_evict_cb+0x6e/0xd0 [ttm] [26620.095705] ttm_lru_walk_for_evict+0xa6/0x200 [ttm] [26620.095708] ttm_bo_alloc_resource+0x185/0x4f0 [ttm] [26620.095709] ? init_object+0x62/0xd0 [26620.095712] ttm_bo_validate+0x7a/0x180 [ttm] [26620.095713] ? _raw_spin_unlock_irqrestore+0x16/0x30 [26620.095714] __i915_ttm_get_pages+0xb0/0x170 [i915] [26620.095737] i915_ttm_get_pages+0x9f/0x150 [i915] [26620.095759] ? i915_gem_do_execbuffer+0xedc/0x2b40 [i915] [26620.095786] ? alloc_debug_processing+0xd0/0x100 [26620.095787] ? _raw_spin_unlock_irqrestore+0x16/0x30 [26620.095788] ? i915_vma_instance+0xa0/0x4e0 [i915] [26620.095822] __i915_gem_object_get_pages+0x2f/0x40 [i915] [26620.095848] i915_vma_pin_ww+0x706/0x980 [i915] [26620.095875] ? i915_gem_do_execbuffer+0xedc/0x2b40 [i915] [26620.095904] eb_validate_vmas+0x170/0xa00 [i915] [26620.095930] i915_gem_do_execbuffer+0x1201/0x2b40 [i915] [26620.095953] ? alloc_debug_processing+0xd0/0x100 [26620.095954] ? _raw_spin_unlock_irqrestore+0x16/0x30 [26620.095955] ? i915_gem_execbuffer2_ioctl+0xc9/0x240 [i915] [26620.095977] ? __wake_up_sync_key+0x32/0x50 [26620.095979] ? i915_gem_execbuffer2_ioctl+0xc9/0x240 [i915] [26620.096001] ? __slab_alloc.isra.0+0x67/0xc0 [26620.096003] i915_gem_execbuffer2_ioctl+0x11a/0x240 [i915] Results from decode_stacktrace.sh pointed to dereference of a file pointer field of a i915 TTM page vector container associated with an object being purged on eviction. That path is taken when the object is marked as no longer needed. Code analysis revealed a possibility of the i915 TTM page vector container being replaced with a new instance inside a function that purges content of the object, should it be still busy. That function is called, indirectly via a more general function that changes the object's placement and caching policy, ---truncated---
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 7ae034590ceaefd4d37465e3434877acfbadf411 , < df73f3bc731af1c39ac5405bc59c4e7c6f8e9117 (git)
Affected: 7ae034590ceaefd4d37465e3434877acfbadf411 , < 28b22dbaf407598cb3bb1d2c586a6f8018690ac2 (git)
Affected: 7ae034590ceaefd4d37465e3434877acfbadf411 , < 073bcbc95e9648c976da1654c7590a8d6ee12c2d (git)
Affected: 7ae034590ceaefd4d37465e3434877acfbadf411 , < c9ae7e7e3bc98615364313b08d7acea5239ded0b (git)
Affected: 7ae034590ceaefd4d37465e3434877acfbadf411 , < a29654d451bbffe63d584a4cf64ad0efce6bcf1c (git)
Affected: 7ae034590ceaefd4d37465e3434877acfbadf411 , < 5c4063c87a619e4df954c179d24628636f5db15f (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.17
Unaffected: 0 , < 5.17 (semver)
Unaffected: 6.1.176 , ≤ 6.1.* (semver)
Unaffected: 6.6.143 , ≤ 6.6.* (semver)
Unaffected: 6.12.93 , ≤ 6.12.* (semver)
Unaffected: 6.18.35 , ≤ 6.18.* (semver)
Unaffected: 7.0.12 , ≤ 7.0.* (semver)
Unaffected: 7.1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/i915/gem/i915_gem_ttm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "df73f3bc731af1c39ac5405bc59c4e7c6f8e9117",
              "status": "affected",
              "version": "7ae034590ceaefd4d37465e3434877acfbadf411",
              "versionType": "git"
            },
            {
              "lessThan": "28b22dbaf407598cb3bb1d2c586a6f8018690ac2",
              "status": "affected",
              "version": "7ae034590ceaefd4d37465e3434877acfbadf411",
              "versionType": "git"
            },
            {
              "lessThan": "073bcbc95e9648c976da1654c7590a8d6ee12c2d",
              "status": "affected",
              "version": "7ae034590ceaefd4d37465e3434877acfbadf411",
              "versionType": "git"
            },
            {
              "lessThan": "c9ae7e7e3bc98615364313b08d7acea5239ded0b",
              "status": "affected",
              "version": "7ae034590ceaefd4d37465e3434877acfbadf411",
              "versionType": "git"
            },
            {
              "lessThan": "a29654d451bbffe63d584a4cf64ad0efce6bcf1c",
              "status": "affected",
              "version": "7ae034590ceaefd4d37465e3434877acfbadf411",
              "versionType": "git"
            },
            {
              "lessThan": "5c4063c87a619e4df954c179d24628636f5db15f",
              "status": "affected",
              "version": "7ae034590ceaefd4d37465e3434877acfbadf411",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/i915/gem/i915_gem_ttm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.17"
            },
            {
              "lessThan": "5.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.176",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.143",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.93",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.35",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.176",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.143",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.93",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.35",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.12",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/i915: Fix potential UAF in TTM object purge\n\nTLDR: The bo-\u003ettm object might be changed by calling ttm_bo_validate(),\n      move casting it to an i915_tt object later to actually get the right\n      pointer.\n\nA user reported hitting the following bug under heavy use on DG2:\n\n[26620.095550] Oops: general protection fault, probably for non-canonical address 0xa56b6b6b6b6b6b8b: 0000 1 SMP NOPTI\n[26620.095556] CPU: 2 UID: 0 PID: 631 Comm: Xorg Not tainted 6.18.8 #1 PREEMPT(lazy)\n[26620.095558] Hardware name: ASRock B850M Steel Legend WiFi/B850M Steel Legend WiFi, BIOS 3.50 09/18/2025\n[26620.095559] RIP: 0010:i915_ttm_purge+0x84/0x100 [i915]\n[26620.095604] Code: 00 00 00 48 8d 54 24 10 48 89 e6 48 89 fb e8 83 aa ae ff 85 c0 75 6f 48 83 bb a8 01 00 00 00 74 2c 48 8b 45 78 48 85 c0 74 23 \u003c48\u003e 8b 78 20 48 c7 c2 ff ff ff ff 31 f6 e8 7a 73 e3 e0 48 8b 7d 78\n[26620.095605] RSP: 0018:ffffc90005fd7430 EFLAGS: 00010282\n[26620.095607] RAX: a56b6b6b6b6b6b6b RBX: ffff8881f46c3dc0 RCX: 0000000000000000\n[26620.095608] RDX: 0000000000000000 RSI: 0000000000000246 RDI: 00000000ffffffff\n[26620.095609] RBP: ffff888289610f00 R08: 0000000000000001 R09: ffff88823b022000\n[26620.095609] R10: ffff888103029b28 R11: ffff8881fc7f3800 R12: ffff88810b6150d0\n[26620.095609] R13: ffff888289610f00 R14: 0000000000000000 R15: ffff8881f46c3dc0\n[26620.095610] FS: 00007f1004d86900(0000) GS:ffff88901c858000(0000) knlGS:0000000000000000\n[26620.095611] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[26620.095611] CR2: 00007f0fdf489000 CR3: 000000035b0c1000 CR4: 0000000000750ef0\n[26620.095612] PKRU: 55555554\n[26620.095612] Call Trace:\n[26620.095615] \u003cTASK\u003e\n[26620.095615] i915_ttm_move+0x2b9/0x420 [i915]\n[26620.095642] ? ttm_tt_init+0x65/0x80 [ttm]\n[26620.095644] ? i915_ttm_tt_create+0xc6/0x150 [i915]\n[26620.095667] ttm_bo_handle_move_mem+0xb6/0x160 [ttm]\n[26620.095669] ttm_bo_evict+0x100/0x150 [ttm]\n[26620.095671] ? preempt_count_add+0x64/0xa0\n[26620.095673] ? _raw_spin_lock+0xe/0x30\n[26620.095675] ? _raw_spin_unlock+0xd/0x30\n[26620.095675] ? i915_gem_object_evictable+0xb7/0xd0 [i915]\n[26620.095704] ttm_bo_evict_cb+0x6e/0xd0 [ttm]\n[26620.095705] ttm_lru_walk_for_evict+0xa6/0x200 [ttm]\n[26620.095708] ttm_bo_alloc_resource+0x185/0x4f0 [ttm]\n[26620.095709] ? init_object+0x62/0xd0\n[26620.095712] ttm_bo_validate+0x7a/0x180 [ttm]\n[26620.095713] ? _raw_spin_unlock_irqrestore+0x16/0x30\n[26620.095714] __i915_ttm_get_pages+0xb0/0x170 [i915]\n[26620.095737] i915_ttm_get_pages+0x9f/0x150 [i915]\n[26620.095759] ? i915_gem_do_execbuffer+0xedc/0x2b40 [i915]\n[26620.095786] ? alloc_debug_processing+0xd0/0x100\n[26620.095787] ? _raw_spin_unlock_irqrestore+0x16/0x30\n[26620.095788] ? i915_vma_instance+0xa0/0x4e0 [i915]\n[26620.095822] __i915_gem_object_get_pages+0x2f/0x40 [i915]\n[26620.095848] i915_vma_pin_ww+0x706/0x980 [i915]\n[26620.095875] ? i915_gem_do_execbuffer+0xedc/0x2b40 [i915]\n[26620.095904] eb_validate_vmas+0x170/0xa00 [i915]\n[26620.095930] i915_gem_do_execbuffer+0x1201/0x2b40 [i915]\n[26620.095953] ? alloc_debug_processing+0xd0/0x100\n[26620.095954] ? _raw_spin_unlock_irqrestore+0x16/0x30\n[26620.095955] ? i915_gem_execbuffer2_ioctl+0xc9/0x240 [i915]\n[26620.095977] ? __wake_up_sync_key+0x32/0x50\n[26620.095979] ? i915_gem_execbuffer2_ioctl+0xc9/0x240 [i915]\n[26620.096001] ? __slab_alloc.isra.0+0x67/0xc0\n[26620.096003] i915_gem_execbuffer2_ioctl+0x11a/0x240 [i915]\n\nResults from decode_stacktrace.sh pointed to dereference of a file pointer\nfield of a i915 TTM page vector container associated with an object being\npurged on eviction.  That path is taken when the object is marked as no\nlonger needed.\n\nCode analysis revealed a possibility of the i915 TTM page vector container\nbeing replaced with a new instance inside a function that purges content\nof the object, should it be still busy.  That function is called,\nindirectly via a more general function that changes the object\u0027s placement\nand caching policy,\n---truncated---"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached only through local DRM ioctls on the Intel GPU render node (notably I915_GEM_EXECBUFFER2 and I915_GEM_MADVISE); there is no network, adjacent-radio, or physical-access entry path.\nAC:L - An attacker controls the triggering workload (concurrent execbuffers, madvise DONTNEED, and GPU memory pressure to force eviction), and the UAF is a deterministic stale-pointer bug rather than a race against uncontrollable system state.\nPR:L - Exploitation requires only access to the DRM render node and standard unprivileged GEM ioctls (DRM_RENDER_ALLOW); no CAP_SYS_ADMIN, DRM master, or init-namespace root is needed.\nUI:N - No victim interaction is required beyond the attacker (or a compromised local GPU client) issuing its own ioctl submissions to the render node.\nS:U - Successful exploitation yields kernel memory corruption and local privilege escalation within the same kernel security authority; it does not constitute a VM escape or IOMMU/DMA boundary bypass.\nC:H - This is a kernel heap use-after-free on a freed i915_ttm_tt structure; attacker-controlled reuse of the freed object can provide arbitrary kernel memory read primitives.\nI:H - UAF on the i915_ttm_tt/filp path enables heap grooming and corrupting kernel objects, providing a standard path to arbitrary kernel write and code execution.\nA:H - The vulnerability was observed causing a kernel general protection fault/oops under real workloads, and UAF in this path can reliably crash or hang the system even before full exploitation."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:36:53.207Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/df73f3bc731af1c39ac5405bc59c4e7c6f8e9117"
        },
        {
          "url": "https://git.kernel.org/stable/c/28b22dbaf407598cb3bb1d2c586a6f8018690ac2"
        },
        {
          "url": "https://git.kernel.org/stable/c/073bcbc95e9648c976da1654c7590a8d6ee12c2d"
        },
        {
          "url": "https://git.kernel.org/stable/c/c9ae7e7e3bc98615364313b08d7acea5239ded0b"
        },
        {
          "url": "https://git.kernel.org/stable/c/a29654d451bbffe63d584a4cf64ad0efce6bcf1c"
        },
        {
          "url": "https://git.kernel.org/stable/c/5c4063c87a619e4df954c179d24628636f5db15f"
        }
      ],
      "title": "drm/i915: Fix potential UAF in TTM object purge",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-63884",
    "datePublished": "2026-07-19T14:54:57.520Z",
    "dateReserved": "2026-07-19T07:54:57.018Z",
    "dateUpdated": "2026-08-05T12:36:53.207Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-63884",
      "date": "2026-09-16",
      "epss": "0.00176",
      "percentile": "0.07361"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-63884\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-07-19T16:17:05.463\",\"lastModified\":\"2026-07-27T17:44:23.777\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm/i915: Fix potential UAF in TTM object purge\\n\\nTLDR: The bo-\u003ettm object might be changed by calling ttm_bo_validate(),\\n      move casting it to an i915_tt object later to actually get the right\\n      pointer.\\n\\nA user reported hitting the following bug under heavy use on DG2:\\n\\n[26620.095550] Oops: general protection fault, probably for non-canonical address 0xa56b6b6b6b6b6b8b: 0000 1 SMP NOPTI\\n[26620.095556] CPU: 2 UID: 0 PID: 631 Comm: Xorg Not tainted 6.18.8 #1 PREEMPT(lazy)\\n[26620.095558] Hardware name: ASRock B850M Steel Legend WiFi/B850M Steel Legend WiFi, BIOS 3.50 09/18/2025\\n[26620.095559] RIP: 0010:i915_ttm_purge+0x84/0x100 [i915]\\n[26620.095604] Code: 00 00 00 48 8d 54 24 10 48 89 e6 48 89 fb e8 83 aa ae ff 85 c0 75 6f 48 83 bb a8 01 00 00 00 74 2c 48 8b 45 78 48 85 c0 74 23 \u003c48\u003e 8b 78 20 48 c7 c2 ff ff ff ff 31 f6 e8 7a 73 e3 e0 48 8b 7d 78\\n[26620.095605] RSP: 0018:ffffc90005fd7430 EFLAGS: 00010282\\n[26620.095607] RAX: a56b6b6b6b6b6b6b RBX: ffff8881f46c3dc0 RCX: 0000000000000000\\n[26620.095608] RDX: 0000000000000000 RSI: 0000000000000246 RDI: 00000000ffffffff\\n[26620.095609] RBP: ffff888289610f00 R08: 0000000000000001 R09: ffff88823b022000\\n[26620.095609] R10: ffff888103029b28 R11: ffff8881fc7f3800 R12: ffff88810b6150d0\\n[26620.095609] R13: ffff888289610f00 R14: 0000000000000000 R15: ffff8881f46c3dc0\\n[26620.095610] FS: 00007f1004d86900(0000) GS:ffff88901c858000(0000) knlGS:0000000000000000\\n[26620.095611] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\n[26620.095611] CR2: 00007f0fdf489000 CR3: 000000035b0c1000 CR4: 0000000000750ef0\\n[26620.095612] PKRU: 55555554\\n[26620.095612] Call Trace:\\n[26620.095615] \u003cTASK\u003e\\n[26620.095615] i915_ttm_move+0x2b9/0x420 [i915]\\n[26620.095642] ? ttm_tt_init+0x65/0x80 [ttm]\\n[26620.095644] ? i915_ttm_tt_create+0xc6/0x150 [i915]\\n[26620.095667] ttm_bo_handle_move_mem+0xb6/0x160 [ttm]\\n[26620.095669] ttm_bo_evict+0x100/0x150 [ttm]\\n[26620.095671] ? preempt_count_add+0x64/0xa0\\n[26620.095673] ? _raw_spin_lock+0xe/0x30\\n[26620.095675] ? _raw_spin_unlock+0xd/0x30\\n[26620.095675] ? i915_gem_object_evictable+0xb7/0xd0 [i915]\\n[26620.095704] ttm_bo_evict_cb+0x6e/0xd0 [ttm]\\n[26620.095705] ttm_lru_walk_for_evict+0xa6/0x200 [ttm]\\n[26620.095708] ttm_bo_alloc_resource+0x185/0x4f0 [ttm]\\n[26620.095709] ? init_object+0x62/0xd0\\n[26620.095712] ttm_bo_validate+0x7a/0x180 [ttm]\\n[26620.095713] ? _raw_spin_unlock_irqrestore+0x16/0x30\\n[26620.095714] __i915_ttm_get_pages+0xb0/0x170 [i915]\\n[26620.095737] i915_ttm_get_pages+0x9f/0x150 [i915]\\n[26620.095759] ? i915_gem_do_execbuffer+0xedc/0x2b40 [i915]\\n[26620.095786] ? alloc_debug_processing+0xd0/0x100\\n[26620.095787] ? _raw_spin_unlock_irqrestore+0x16/0x30\\n[26620.095788] ? i915_vma_instance+0xa0/0x4e0 [i915]\\n[26620.095822] __i915_gem_object_get_pages+0x2f/0x40 [i915]\\n[26620.095848] i915_vma_pin_ww+0x706/0x980 [i915]\\n[26620.095875] ? i915_gem_do_execbuffer+0xedc/0x2b40 [i915]\\n[26620.095904] eb_validate_vmas+0x170/0xa00 [i915]\\n[26620.095930] i915_gem_do_execbuffer+0x1201/0x2b40 [i915]\\n[26620.095953] ? alloc_debug_processing+0xd0/0x100\\n[26620.095954] ? _raw_spin_unlock_irqrestore+0x16/0x30\\n[26620.095955] ? i915_gem_execbuffer2_ioctl+0xc9/0x240 [i915]\\n[26620.095977] ? __wake_up_sync_key+0x32/0x50\\n[26620.095979] ? i915_gem_execbuffer2_ioctl+0xc9/0x240 [i915]\\n[26620.096001] ? __slab_alloc.isra.0+0x67/0xc0\\n[26620.096003] i915_gem_execbuffer2_ioctl+0x11a/0x240 [i915]\\n\\nResults from decode_stacktrace.sh pointed to dereference of a file pointer\\nfield of a i915 TTM page vector container associated with an object being\\npurged on eviction.  That path is taken when the object is marked as no\\nlonger needed.\\n\\nCode analysis revealed a possibility of the i915 TTM page vector container\\nbeing replaced with a new instance inside a function that purges content\\nof the object, should it be still busy.  That function is called,\\nindirectly via a more general function that changes the object\u0027s placement\\nand caching policy,\\n---truncated---\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/gpu/drm/i915/gem/i915_gem_ttm.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"7ae034590ceaefd4d37465e3434877acfbadf411\",\"lessThan\":\"df73f3bc731af1c39ac5405bc59c4e7c6f8e9117\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7ae034590ceaefd4d37465e3434877acfbadf411\",\"lessThan\":\"28b22dbaf407598cb3bb1d2c586a6f8018690ac2\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7ae034590ceaefd4d37465e3434877acfbadf411\",\"lessThan\":\"073bcbc95e9648c976da1654c7590a8d6ee12c2d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7ae034590ceaefd4d37465e3434877acfbadf411\",\"lessThan\":\"c9ae7e7e3bc98615364313b08d7acea5239ded0b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7ae034590ceaefd4d37465e3434877acfbadf411\",\"lessThan\":\"a29654d451bbffe63d584a4cf64ad0efce6bcf1c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7ae034590ceaefd4d37465e3434877acfbadf411\",\"lessThan\":\"5c4063c87a619e4df954c179d24628636f5db15f\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/gpu/drm/i915/gem/i915_gem_ttm.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.17\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.17\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.176\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.143\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.93\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.35\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.0.12\",\"lessThanOrEqual\":\"7.0.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/073bcbc95e9648c976da1654c7590a8d6ee12c2d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/28b22dbaf407598cb3bb1d2c586a6f8018690ac2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/5c4063c87a619e4df954c179d24628636f5db15f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/a29654d451bbffe63d584a4cf64ad0efce6bcf1c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/c9ae7e7e3bc98615364313b08d7acea5239ded0b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/df73f3bc731af1c39ac5405bc59c4e7c6f8e9117\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-08-20T08:01:20+00:00",
      "cve": "CVE-2026-63884",
      "id": "CVE-2026-63884",
      "initial_release_date": "2026-07-19T00:00:00+00:00",
      "product_status:fixed": "762",
      "product_status:known_affected": "22",
      "product_status:known_not_affected": "28",
      "product_status:under_investigation": "14",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: drm/i915: Fix potential UAF in TTM object purge",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-63884.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-08-31T16:32:19Z",
      "cve": "CVE-2026-63884",
      "id": "CVE-2026-63884",
      "initial_release_date": "2026-07-21T13:04:16Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "398",
      "product_status:known_not_affected": "268",
      "product_status:recommended": "451",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-63884",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-63884.json",
      "version": "11"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.