CVE-2026-99000 (GCVE-0-2026-99000)

Vulnerability from cvelistv5 – Published: 2026-10-23 12:20 – Updated: 2026-10-23 12:20
VLAI
Title
drm/xe: Fix shrinker accounting double-subtraction on nested external pins
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix shrinker accounting double-subtraction on nested external pins xe_bo_pin_external() and xe_bo_unpin_external() support nested pins, since the underlying ttm_bo_pin()/ttm_bo_unpin() maintain a pin_count refcount rather than a boolean. However, the shrinker accounting calls xe_ttm_tt_account_subtract() and xe_ttm_tt_account_add() are invoked unconditionally on every pin_external()/unpin_external() call, instead of only on the transition into and out of the pinned state. An external BO (dma-buf) can be pinned more than once while already pinned, for example when it has multiple attachments/importers, each independently calling xe_bo_pin_external(). Each such nested pin subtracts the BO's pages from the shrinker's accounting again, even though the BO's pages were already removed from consideration by the first pin. Symmetrically, each nested unpin adds them back again before the BO is actually unpinned. This desynchronizes the shrinker's page and object counts from reality, and since they are declared as signed long but interpreted as unsigned long in xe_shrinker_count(), the underflow can turn into an enormous shrinkable/purgeable page count, causing the shrinker to be invoked excessively under memory pressure. Guard the accounting calls with the same pin-count transition checks already used to guard the pinned_link list maintenance, so accounting is only updated on the outermost pin and the final unpin. While centralizing this logic into xe_bo_account_pin()/ xe_bo_account_unpin(), also close a second, related accounting gap affecting imported dma-bufs. For an imported bo's ttm_tt, xe's ttm_tt_populate hook (xe_ttm_tt_populate()) early-returns without calling xe_ttm_tt_account_add(), since TTM_TT_FLAG_EXTERNAL is set without TTM_TT_FLAG_EXTERNAL_MAPPABLE. However, TTM core's ttm_tt_populate() wrapper unconditionally marks the tt as populated on driver-hook success, so ttm_tt_is_populated() still reports true for it. xe_bo_account_pin()/xe_bo_account_unpin() trusted ttm_tt_is_populated() as a proxy for "these pages are accounted for by the shrinker", and would subtract/add pages for such a tt that were never added in the first place, again underflowing the shrinker's counts. This is reachable today via xe_bo_pin_external(), and would have become newly reachable via the fb-pin path once this patch routes __xe_pin_fb_vma() through xe_bo_pin_account() below, so fix it here rather than in a later patch, to avoid a commit in this series that introduces the regression before fixing it. Skip the accounting for imported bos, using the same EXTERNAL && !EXTERNAL_MAPPABLE test xe_ttm_tt_populate()/xe_ttm_tt_unpopulate() use to decide whether to act, via a new xe_ttm_bo_is_imported() helper (hoisted up from its only prior use site). v2: - Fix the critical issue caught by Sashiko AI review: the pin-count transition check introduced here was still bypassed by the fb-pin path (__xe_pin_fb_vma()/__xe_unpin_fb_vma()), which could leave a stale pinned_link entry and a permanent shrinker accounting leak when the fb-unpin performed the true last unpin. Addressed in a separate follow-up patch in this series rather than folded in here, since it is a distinct bug with its own Fixes: tag. - Drop the unneeded local "last_unpin" variable in xe_bo_unpin_external(), restoring the original inline bo->ttm.pin_count == 1 check; it was a no-op rename not used by any of the new accounting helpers, and was going to be deleted again by the follow-up patch anyway. v3: - Exclude imported dma-bufs from the pin/unpin shrinker accounting, fixing another underflow caught by Sashiko AI review. - Add a short comment on the backup-object pin site noting it's already populated/accounted at pin time, addressing (as a false-positive clarification, no code fix needed) a separate Medium-severity accounting-leak concern also caught by Sashiko AI ---truncated---
Severity
No CVSS data available.
Assigner
Linux CNA under the mitre root
CNA scorecard D 53/100 over 7056 records in the last 180 days details
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 00c8efc3180f0cf919b53980e969430657e01685 , < 993c952e6832ad0aa4be82e11f0760b1f532090a (git)
Affected: 00c8efc3180f0cf919b53980e969430657e01685 , < ab39bc55cf08208b8511b1c09926b1b646a8befc (git)
Affected: 00c8efc3180f0cf919b53980e969430657e01685 , < 83d5acca1f4f6132038ea88c72c5844f62e42d44 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.15
Unaffected: 0 , < 6.15 (semver)
Unaffected: 6.18.57 , ≤ 6.18.* (semver)
Unaffected: 7.2.11 , ≤ 7.2.* (semver)
Unaffected: 7.3 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/xe/display/xe_fb_pin.c",
            "drivers/gpu/drm/xe/xe_bo.c",
            "drivers/gpu/drm/xe/xe_bo.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "993c952e6832ad0aa4be82e11f0760b1f532090a",
              "status": "affected",
              "version": "00c8efc3180f0cf919b53980e969430657e01685",
              "versionType": "git"
            },
            {
              "lessThan": "ab39bc55cf08208b8511b1c09926b1b646a8befc",
              "status": "affected",
              "version": "00c8efc3180f0cf919b53980e969430657e01685",
              "versionType": "git"
            },
            {
              "lessThan": "83d5acca1f4f6132038ea88c72c5844f62e42d44",
              "status": "affected",
              "version": "00c8efc3180f0cf919b53980e969430657e01685",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/xe/display/xe_fb_pin.c",
            "drivers/gpu/drm/xe/xe_bo.c",
            "drivers/gpu/drm/xe/xe_bo.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.15"
            },
            {
              "lessThan": "6.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.57",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.57",
                  "versionStartIncluding": "6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.11",
                  "versionStartIncluding": "6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "6.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe: Fix shrinker accounting double-subtraction on nested external pins\n\nxe_bo_pin_external() and xe_bo_unpin_external() support nested pins,\nsince the underlying ttm_bo_pin()/ttm_bo_unpin() maintain a pin_count\nrefcount rather than a boolean. However, the shrinker accounting calls\nxe_ttm_tt_account_subtract() and xe_ttm_tt_account_add() are invoked\nunconditionally on every pin_external()/unpin_external() call, instead\nof only on the transition into and out of the pinned state.\n\nAn external BO (dma-buf) can be pinned more than once while already\npinned, for example when it has multiple attachments/importers, each\nindependently calling xe_bo_pin_external(). Each such nested pin\nsubtracts the BO\u0027s pages from the shrinker\u0027s accounting again, even\nthough the BO\u0027s pages were already removed from consideration by the\nfirst pin. Symmetrically, each nested unpin adds them back again\nbefore the BO is actually unpinned. This desynchronizes the\nshrinker\u0027s page and object counts from reality, and since they are\ndeclared as signed long but interpreted as unsigned long in\nxe_shrinker_count(), the underflow can turn into an enormous\nshrinkable/purgeable page count, causing the shrinker to be invoked\nexcessively under memory pressure.\n\nGuard the accounting calls with the same pin-count transition checks\nalready used to guard the pinned_link list maintenance, so accounting\nis only updated on the outermost pin and the final unpin.\n\nWhile centralizing this logic into xe_bo_account_pin()/\nxe_bo_account_unpin(), also close a second, related accounting gap\naffecting imported dma-bufs. For an imported bo\u0027s ttm_tt, xe\u0027s\nttm_tt_populate hook (xe_ttm_tt_populate()) early-returns without\ncalling xe_ttm_tt_account_add(), since TTM_TT_FLAG_EXTERNAL is set\nwithout TTM_TT_FLAG_EXTERNAL_MAPPABLE. However, TTM core\u0027s\nttm_tt_populate() wrapper unconditionally marks the tt as populated\non driver-hook success, so ttm_tt_is_populated() still reports true\nfor it. xe_bo_account_pin()/xe_bo_account_unpin() trusted\nttm_tt_is_populated() as a proxy for \"these pages are accounted for\nby the shrinker\", and would subtract/add pages for such a tt that\nwere never added in the first place, again underflowing the\nshrinker\u0027s counts. This is reachable today via xe_bo_pin_external(),\nand would have become newly reachable via the fb-pin path once this\npatch routes __xe_pin_fb_vma() through xe_bo_pin_account() below, so\nfix it here rather than in a later patch, to avoid a commit in this\nseries that introduces the regression before fixing it. Skip the\naccounting for imported bos, using the same EXTERNAL \u0026\u0026\n!EXTERNAL_MAPPABLE test xe_ttm_tt_populate()/xe_ttm_tt_unpopulate()\nuse to decide whether to act, via a new xe_ttm_bo_is_imported()\nhelper (hoisted up from its only prior use site).\n\nv2:\n- Fix the critical issue caught by Sashiko AI review: the pin-count\n  transition check introduced here was still bypassed by the fb-pin\n  path (__xe_pin_fb_vma()/__xe_unpin_fb_vma()), which could leave a\n  stale pinned_link entry and a permanent shrinker accounting leak\n  when the fb-unpin performed the true last unpin. Addressed in a\n  separate follow-up patch in this series rather than folded in here,\n  since it is a distinct bug with its own Fixes: tag.\n- Drop the unneeded local \"last_unpin\" variable in\n  xe_bo_unpin_external(), restoring the original inline\n  bo-\u003ettm.pin_count == 1 check; it was a no-op rename not used by any\n  of the new accounting helpers, and was going to be deleted again by\n  the follow-up patch anyway.\n\nv3:\n- Exclude imported dma-bufs from the pin/unpin shrinker accounting,\n  fixing another underflow caught by Sashiko AI review.\n- Add a short comment on the backup-object pin site noting it\u0027s\n  already populated/accounted at pin time, addressing (as a\n  false-positive clarification, no code fix needed) a separate\n  Medium-severity accounting-leak concern also caught by Sashiko AI\n  \n---truncated---"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-23T12:20:20.753Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/993c952e6832ad0aa4be82e11f0760b1f532090a"
        },
        {
          "url": "https://git.kernel.org/stable/c/ab39bc55cf08208b8511b1c09926b1b646a8befc"
        },
        {
          "url": "https://git.kernel.org/stable/c/83d5acca1f4f6132038ea88c72c5844f62e42d44"
        }
      ],
      "title": "drm/xe: Fix shrinker accounting double-subtraction on nested external pins",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-99000",
    "datePublished": "2026-10-23T12:20:20.753Z",
    "dateReserved": "2026-09-25T10:25:14.385Z",
    "dateUpdated": "2026-10-23T12:20:20.753Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-99000",
      "date": "2026-10-24",
      "epss": "0.00219",
      "percentile": "0.11785"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/gpu/drm/xe/display/xe_fb_pin.c",
                  "drivers/gpu/drm/xe/xe_bo.c",
                  "drivers/gpu/drm/xe/xe_bo.h"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "993c952e6832ad0aa4be82e11f0760b1f532090a",
                    "status": "affected",
                    "version": "00c8efc3180f0cf919b53980e969430657e01685",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "ab39bc55cf08208b8511b1c09926b1b646a8befc",
                    "status": "affected",
                    "version": "00c8efc3180f0cf919b53980e969430657e01685",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "83d5acca1f4f6132038ea88c72c5844f62e42d44",
                    "status": "affected",
                    "version": "00c8efc3180f0cf919b53980e969430657e01685",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/gpu/drm/xe/display/xe_fb_pin.c",
                  "drivers/gpu/drm/xe/xe_bo.c",
                  "drivers/gpu/drm/xe/xe_bo.h"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.15"
                  },
                  {
                    "lessThan": "6.15",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.57",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.11",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe: Fix shrinker accounting double-subtraction on nested external pins\n\nxe_bo_pin_external() and xe_bo_unpin_external() support nested pins,\nsince the underlying ttm_bo_pin()/ttm_bo_unpin() maintain a pin_count\nrefcount rather than a boolean. However, the shrinker accounting calls\nxe_ttm_tt_account_subtract() and xe_ttm_tt_account_add() are invoked\nunconditionally on every pin_external()/unpin_external() call, instead\nof only on the transition into and out of the pinned state.\n\nAn external BO (dma-buf) can be pinned more than once while already\npinned, for example when it has multiple attachments/importers, each\nindependently calling xe_bo_pin_external(). Each such nested pin\nsubtracts the BO\u0027s pages from the shrinker\u0027s accounting again, even\nthough the BO\u0027s pages were already removed from consideration by the\nfirst pin. Symmetrically, each nested unpin adds them back again\nbefore the BO is actually unpinned. This desynchronizes the\nshrinker\u0027s page and object counts from reality, and since they are\ndeclared as signed long but interpreted as unsigned long in\nxe_shrinker_count(), the underflow can turn into an enormous\nshrinkable/purgeable page count, causing the shrinker to be invoked\nexcessively under memory pressure.\n\nGuard the accounting calls with the same pin-count transition checks\nalready used to guard the pinned_link list maintenance, so accounting\nis only updated on the outermost pin and the final unpin.\n\nWhile centralizing this logic into xe_bo_account_pin()/\nxe_bo_account_unpin(), also close a second, related accounting gap\naffecting imported dma-bufs. For an imported bo\u0027s ttm_tt, xe\u0027s\nttm_tt_populate hook (xe_ttm_tt_populate()) early-returns without\ncalling xe_ttm_tt_account_add(), since TTM_TT_FLAG_EXTERNAL is set\nwithout TTM_TT_FLAG_EXTERNAL_MAPPABLE. However, TTM core\u0027s\nttm_tt_populate() wrapper unconditionally marks the tt as populated\non driver-hook success, so ttm_tt_is_populated() still reports true\nfor it. xe_bo_account_pin()/xe_bo_account_unpin() trusted\nttm_tt_is_populated() as a proxy for \"these pages are accounted for\nby the shrinker\", and would subtract/add pages for such a tt that\nwere never added in the first place, again underflowing the\nshrinker\u0027s counts. This is reachable today via xe_bo_pin_external(),\nand would have become newly reachable via the fb-pin path once this\npatch routes __xe_pin_fb_vma() through xe_bo_pin_account() below, so\nfix it here rather than in a later patch, to avoid a commit in this\nseries that introduces the regression before fixing it. Skip the\naccounting for imported bos, using the same EXTERNAL \u0026\u0026\n!EXTERNAL_MAPPABLE test xe_ttm_tt_populate()/xe_ttm_tt_unpopulate()\nuse to decide whether to act, via a new xe_ttm_bo_is_imported()\nhelper (hoisted up from its only prior use site).\n\nv2:\n- Fix the critical issue caught by Sashiko AI review: the pin-count\n  transition check introduced here was still bypassed by the fb-pin\n  path (__xe_pin_fb_vma()/__xe_unpin_fb_vma()), which could leave a\n  stale pinned_link entry and a permanent shrinker accounting leak\n  when the fb-unpin performed the true last unpin. Addressed in a\n  separate follow-up patch in this series rather than folded in here,\n  since it is a distinct bug with its own Fixes: tag.\n- Drop the unneeded local \"last_unpin\" variable in\n  xe_bo_unpin_external(), restoring the original inline\n  bo-\u003ettm.pin_count == 1 check; it was a no-op rename not used by any\n  of the new accounting helpers, and was going to be deleted again by\n  the follow-up patch anyway.\n\nv3:\n- Exclude imported dma-bufs from the pin/unpin shrinker accounting,\n  fixing another underflow caught by Sashiko AI review.\n- Add a short comment on the backup-object pin site noting it\u0027s\n  already populated/accounted at pin time, addressing (as a\n  false-positive clarification, no code fix needed) a separate\n  Medium-severity accounting-leak concern also caught by Sashiko AI\n  \n---truncated---"
          }
        ],
        "id": "CVE-2026-99000",
        "lastModified": "2026-10-23T13:17:22.297",
        "metrics": {},
        "published": "2026-10-23T13:17:22.297",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/83d5acca1f4f6132038ea88c72c5844f62e42d44"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/993c952e6832ad0aa4be82e11f0760b1f532090a"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/ab39bc55cf08208b8511b1c09926b1b646a8befc"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.