UBUNTU-CVE-2026-68239: Null Pointer Dereference
In the Linux kernel, the following vulnerability has been resolved: drm/ttm: Account for NULL and handle pages in ttmpoolbackup Pages in ttmpoolbackup can be NULL or backup handles (ttmbackuppageptrishandle()), neither of which can be passed to setpagesarraywb() or freed. Add a dedicated WB pass before the dma/purge loop that walks allocations using the same i += numpages stride, skipping NULL and handle entries, and calls setpagesarraywb() once per contiguous run of real pages. Apply the same NULL/handle guard to the dma/purge loop. Fixes the following oops: Oops: general protection fault, kernel NULL pointer dereference 0x0: 0000 [#1] SMP NOPTI RIP: 0010:cpaprocessfault+0xf8/0x770 RSP: 0018:ffffc90000a87718 EFLAGS: 00010287 RAX: 0000000000000000 RBX: ffffc90000a87868 RCX: 0000000000000000 RDX: 0000000000001000 RSI: 0005088000000000 RDI: ffffffff827c5f34 RBP: 0005088000000000 R08: ffffc90000a877cb R09: ffffc90000a877d0 R10: 0000000000000000 R11: 000000000000001b R12: 000ffffffffff000 R13: ffffc90000a87868 R14: ffffc90000a87868 R15: ffff88815b882ae0 FS: 0000000000000000(0000) GS:ffff8884ec840000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f930b844000 CR3: 000000000262e003 CR4: 0000000008f70ef0 PKRU: 55555554 Call Trace: <TASK> changepageattrsetclr+0x989/0xe90 ? purgevmaparealazy+0x6c/0x3a0 ? vmunmapaliases+0x250/0x2a0 setpagesarraywb+0x7f/0x120 ttmpoolbackup+0x4c9/0x5b0 [ttm] ? dmaresvwaittimeout+0x3b/0xf0 ttmttbackup+0x32/0x60 [ttm] ttmboshrink+0x66/0x110 [ttm] xeboshrinkpurge+0x12b/0x1b0 [xe] xeboshrink+0xbb/0x270 [xe] xeshrinkerwalk+0xf7/0x160 [xe] xeshrinkerwalk+0x9d/0xc0 [xe] xeshrinkerscan+0x11f/0x210 [xe] doshrinkslab+0x13b/0x270 shrinkslab+0xf1/0x400 shrinknode+0x352/0x8a0 balancepgdat+0x32c/0x700 kswapd+0x205/0x2f0 ? pfxautoremovewakefunction+0x10/0x10 ? pfxkswapd+0x10/0x10 kthread+0xd1/0x110 ? pfxkthread+0x10/0x10 retfromfork+0x1b1/0x200 ? pfxkthread+0x10/0x10 retfromforkasm+0x1a/0x30 </TASK>
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-aws-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1014.14~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-fde-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1016.16~24.04.1 - Upgrade
Upgrade
ubuntu/linux-gcp-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1014.14~24.04.1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-38.38~24.04.4 - Upgrade
Upgrade
ubuntu/linux-nvidia-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1024.25~24.04.1 - Upgrade
Upgrade
ubuntu/linux-oracle-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1013.13~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-38.38 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1014.14 - Upgrade
Upgrade
ubuntu/linux-azureto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-azure-fdeto a version that resolves this vulnerability.Fixed in 7.0.0-1016.16 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1014.14 - Upgrade
Upgrade
ubuntu/linux-gketo a version that resolves this vulnerability.Fixed in 7.0.0-1008.9 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1015.15 - Upgrade
Upgrade
ubuntu/linux-nvidia-bosto a version that resolves this vulnerability.Fixed in 7.0.0-2022.23 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1015.15 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1013.13 - Upgrade
Upgrade
ubuntu/linux-realtimeto a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1 - Compensating control
In ttm_pool_backup, add a dedicated write-back pass before the dma/purge loop that walks allocations using the i += num_pages stride, skips NULL and ttm_backup_page_ptr_is_handle() entries, and calls set_pages_array_wb() once per contiguous run of real pages; apply the same NULL/handle guard to the dma/purge loop so those entries are not passed to set_pages_array_wb() or freed.
Event History
Frequently Asked Questions
What systems are affected by the listed Ubuntu advisory?
The advisory lists Ubuntu kernel packages for linux-riscv, linux-realtime, linux-hwe-edge, linux-azure, linux-gcp, linux-azure-fde, linux-gke, and linux-aws-5.0. No affected or fixed package versions are provided in the available data.
What operational impact is indicated if the flaw is triggered?
The provided crash report shows a general protection fault and kernel NULL pointer dereference. This indicates the issue can cause a kernel oops or system instability when the affected ttm_pool_backup path processes NULL entries or backup handles.
What conditions in the affected code lead to the failure?
The failure occurs when pages in ttm_pool_backup are NULL or backup handles but are passed to set_pages_array_wb() or freed. The fix skips those entries during writeback, DMA, and purge processing, while handling contiguous runs of real pages separately.