drm/xe: Fix shrinker accounting double-subtraction on nested external pins
In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix shrinker accounting double-subtraction on nested external pins xe_bo_pin_external() and xe_bo_unpin_external() support nested pins, since the underlying ttm_bo_pin()/ttm_bo_unpin() maintain a pin_count refcount rather than a boolean. However, the shrinker accounting calls xe_ttm_tt_account_subtract() and xe_ttm_tt_account_add() are invoked unconditionally on every pin_external()/unpin_external() call, instead of only on the transition into and out of the pinned state. An external BO (dma-buf) can be pinned more than once while already pinned, for example when it has multiple attachments/importers, each independently calling xe_bo_pin_external(). Each such nested pin subtracts the BO's pages from the shrinker's accounting again, even though the BO's pages were already removed from consideration by the first pin. Symmetrically, each nested unpin adds them back again before the BO is actually unpinned. This desynchronizes the shrinker's page and object counts from reality, and since they are declared as signed long but interpreted as unsigned long in xe_shrinker_count(), the underflow can turn into an enormous shrinkable/purgeable page count, causing the shrinker to be invoked excessively under memory pressure. Guard the accounting calls with the same pin-count transition checks already used to guard the pinned_link list maintenance, so accounting is only updated on the outermost pin and the final un
CVE-2026-99000
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-99000
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "00c8efc3180f0cf919b53980e969430657e01685",
"lessThan": "993c952e6832ad0aa4be82e11f0760b1f532090a",
"versionType": "git"
},
{
"status": "affected",
"version": "00c8efc3180f0cf919b53980e969430657e01685",
"lessThan": "ab39bc55cf08208b8511b1c09926b1b646a8befc",
"versionType": "git"
},
{
"status": "affected",
"version": "00c8efc3180f0cf919b53980e969430657e01685",
"lessThan": "83d5acca1f4f6132038ea88c72c5844f62e42d44",
"versionType": "git"
}
],
"programFiles": [
"drivers/gpu/drm/xe/display/xe_fb_pin.c",
"drivers/gpu/drm/xe/xe_bo.c",
"drivers/gpu/drm/xe/xe_bo.h"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "6.15"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "6.15",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.2.11",
"versionType": "semver",
"lessThanOrEqual": "7.2.*"
},
{
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"drivers/gpu/drm/xe/display/xe_fb_pin.c",
"drivers/gpu/drm/xe/xe_bo.c",
"drivers/gpu/drm/xe/xe_bo.h"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2026-99000
Source reference:
/cveMetadata/cveId
Publisher severity
No explicit severity was provided.
- Event
- #52843 · Revision 1
- Added to Heist Feed
- Publisher date