1. The kernel CVE team has assigned CVE-2026-98166 to this fix (announced 2026-10-06): https://lore.kernel.org/linux-cve-announce/2026100629-CVE-2026-98166-db99@gregkh/ https://cve.org/CVERecord/?id=CVE-2026-98166 The record lists the issue as introduced in 7.0.10 by stable commit 0124a09e3e5f ("drm/ttm: Fix ttm_bo_swapout() infinite LRU walk on swapout failure", upstream b2ed01e7ad3d), which is the commit the Resolute 7.0.0 kernel carries, and as fixed in 7.2.8 (1169fe8c11ca) and 7.3-rc4 (3db7d7d58341 + fcfe64715b42). No fix is listed for 7.0.y because that series is no longer maintained upstream, so the fix will not arrive in Resolute through a stable update; it needs to be picked up here.
2. The same bug has now been found in 6.18 LTS as well: 6.18.57 picked up the breaking commit without the fix (reported by Dave Airlie), and Sasha Levin queued the squashed backport from the 7.2.y thread for 6.18 on 2026-10-19: https://lore.kernel.org/stable/[email protected]/T/#u That squashed patch is the same one-line change as the [SRU][Resolute] patch attached to this bug; it applies to the Resolute tree as is. 3. 7.0.0-38.38 still ships the unfixed code (`if (!ret)` after ttm_tt_swapout() in ttm_bo_swapout_cb()); with the patched ttm.ko (in use since 2026-09-09) there has been no recurrence. Could the kernel team link CVE-2026-98166 to this bug and consider the patch for the next Resolute SRU cycle? ** CVE added: https://cve.org/CVERecord?id=CVE-2026-98166 -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2168554 Title: drm/ttm: use-after-free of the bulk_move cursor after hibernation or memory-pressure swapout (amdgpu), fixed upstream in v7.3-rc4 / 7.2.8 To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2168554/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
