CVE-2026-98166
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
A vulnerability in the Linux kernel's DRM/TTM subsystem causes swapped-out resources to remain in their bulk_move range, leading to a use-after-free and system crashes. The bug manifests after hibernation or during process exit/reboot.
Risk Assessment
The risk includes system instability, crashes, and potential privilege escalation or data integrity compromise due to use-after-free. An attacker could exploit this to execute arbitrary code in kernel context.
Recommendation
Immediately update the Linux kernel to a version containing the fix (commit testing the success condition of swapout). If not possible, limit hibernation usage and monitor for unusual crashes.
Related vulnerabilities
- CVE-2026-115812Critical
A relative path traversal during model archive extraction in AWS Multi Model Server 1.1.11 and earlier allows remote actors to execute arbitrary code via a crafted model archive. The project is end of life and no fixed version is available.
- CVE-2026-55486Critical
In Goobi viewer from version 25.08 to before 26.05, the IIIF Auth 2.0 endpoints auth/login and auth/token accept an origin query parameter without validation and embed it into the Content-Security-Policy header and an HTML response body as a postMessage argument. Since the attacker controls both calls, the unescaped value yields reflected XSS.
- CVE-2026-53942Critical
In conda/conda prior to commit 9c0f238, a GitHub Actions Pwn Request vulnerability remains in .github/workflows/update.yml. It is triggered by comments containing @conda-bot render or @conda-bot recreate, allowing an untrusted PR to reach Jinja2 template rendering in a privileged token context.
- CVE-2026-46652Critical
In Goobi viewer from version 24.03 to before 26.05, ExternalFilesDownloader.getFilename() extracts the filename from a server-supplied Content-Disposition header and passes it directly to Path.resolve() without stripping directory components. A malicious HTTP server can supply an absolute path or ../ sequences, writing attacker-controlled content to an arbitrary path, leading to remote code execution.
- CVE-2026-46651Critical
In Goobi viewer from version 24.03 to before 26.05, the DownloadTaskEndpoint WebSocket endpoint (/tasks/download/monitor.socket) in goobi-viewer-core accepts download requests from unauthenticated users. This issue has been patched in version 26.05.
- CVE-2026-53921Critical
In odhcpd (the DHCPv6/DHCPv4/RA server used by OpenWrt) prior to version 25.12, the DHCPv6 IA response handler writes past a fixed 512-byte stack buffer (pdbuf) when a single DHCPv6 REQUEST carries enough IA options to nearly exhaust the reply space. Two independent overflow sites exist in the same call chain, both reachable over the network via a single unauthenticated UDP packet. odhcpd runs as root on OpenWrt, and embedded targets often lack stack canaries and ASLR, making code execution realistic.
- CVE-2026-114357Critical
In DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9, the Android Debug Bridge daemon (adbd) lacks authentication for a critical function. The device ships with ro.adb.secure=0 and USB ADB enabled by default; once ADB over TCP is enabled, the same unauthenticated shell (uid 2000) is reachable over the network. This provides a foothold for privilege escalation to root.
- CVE-2026-57116Critical
In PraisonAI from version 4.2.1 to before 4.6.59, the AgentOS FastAPI deployment surface remains unauthenticated despite the earlier fix for CVE-2026-40151. The chat route directly calls agent.chat(request.message), and both no-auth and wrong-bearer requests execute the deployed agent.
- CVE-2026-112859Critical
The Little Birdies WordPress theme contains a deserialization of untrusted data vulnerability that allows object injection. This issue affects Little Birdies from n/a through 1.3.16.
- CVE-2026-112858Critical
The Rhodos WordPress theme contains a deserialization of untrusted data vulnerability that allows object injection. This issue affects Rhodos from n/a through 1.3.3.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: drm/ttm: fix swapped-out resources never leaving their bulk_move range ttm_tt_swapout() returns the number of pages swapped out on success and a negative error code on failure; for a populated ttm it never returns zero. Commit b2ed01e7ad3d ("drm/ttm: Fix ttm_bo_swapout() infinite LRU walk on swapout failure") moved the bulk_move bookkeeping in ttm_bo_swapout_cb() under "if (!ret)", so the ttm_resource_del_bulk_move_unevictable() / ttm_resource_move_to_lru_tail() pair is now skipped on every successful swapout. The equivalent change for the shrinker in commit 1d59f36e95f7 ("drm/ttm: Fix ttm_bo_shrink() infinite LRU walk on backup failure") tests "lret > 0", which is what was intended here as well. Before b2ed01e7ad3d the resource was taken off the bulk_move before the swapout; since then a swapped-out resource stays inside its BO's bulk_move range (and on the manager LRU) although it is unevictable. When it is later freed or the BO leaves the bulk_move (ttm_resource_free(), ttm_bo_set_bulk_move() via amdgpu_vm_bo_del()), ttm_resource_del_bulk_move() skips it because of its !ttm_resource_unevictable() guard, so a range endpoint in pos->first / pos->last is left pointing at freed memory. The next ttm_lru_bulk_move_tail() or ttm_resource_add_bulk_move() on that cursor is a use-after-free, seen as the resv WARN in ttm_lru_bulk_move_add(), "list_del corruption" in ttm_resource_move_to_lru_tail() or a NULL dereference in ttm_resource_manager_next() -- minutes to hours after a hibernation, or at process exit / reboot following one. Samuel Ainsworth's analysis of drm/amd issue 5387 (see Link) identified the dangling cursor; the missing removal at swapout time is the reason it dangles. Testing the condition for success restores the removal. On an AMD Phoenix APU (ASUS UM3406GA, gfx1103) running suspend-then-hibernate on a 7.0.y stable kernel carrying the backport (Ubuntu 7.0.0-31) the bug crashed 5 of 18 hibernation cycles; a function profile of one hibernation showed 336 ttm_tt_swapout() calls and zero ttm_resource_del_bulk_move_unevictable() calls. With this change the removal happens for every swapped-out resource and 12 further cycles were clean.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS