{"id":"CVE-2026-99000","revision":null,"records":[{"revision":"1dc1a13744c9458491914609963b85d2","observedAt":"2026-10-23T16:01:20.601+00:00","statement":{"source":"cve-program","id":"CVE-2026-99000","aliases":[],"title":"drm/xe: Fix shrinker accounting double-subtraction on nested external pins","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe: Fix shrinker accounting double-subtraction on nested external pins\n\nxe_bo_pin_external() and xe_bo_unpin_external() support nested pins,\nsince the underlying ttm_bo_pin()/ttm_bo_unpin() maintain a pin_count\nrefcount rather than a boolean. However, the shrinker accounting calls\nxe_ttm_tt_account_subtract() and xe_ttm_tt_account_add() are invoked\nunconditionally on every pin_external()/unpin_external() call, instead\nof only on the transition into and out of the pinned state.\n\nAn external BO (dma-buf) can be pinned more than once while already\npinned, for example when it has multiple attachments/importers, each\nindependently calling xe_bo_pin_external(). Each such nested pin\nsubtracts the BO's pages from the shrinker's accounting again, even\nthough the BO's pages were already removed from consideration by the\nfirst pin. Symmetrically, each nested unpin adds them back again\nbefore the BO is actually unpinned. This desynchronizes the\nshrinker's page and object counts from reality, and since they are\ndeclared as signed long but interpreted as unsigned long in\nxe_shrinker_count(), the underflow can turn into an enormous\nshrinkable/purgeable page count, causing the shrinker to be invoked\nexcessively under memory pressure.\n\nGuard the accounting calls with the same pin-count transition checks\nalready used to guard the pinned_link list maintenance, so accounting\nis only updated on the outermost pin and the final unpin.\n\nWhile centralizing this logic into xe_bo_account_pin()/\nxe_bo_account_unpin(), also close a second, related accounting gap\naffecting imported dma-bufs. For an imported bo's ttm_tt, xe's\nttm_tt_populate hook (xe_ttm_tt_populate()) early-returns without\ncalling xe_ttm_tt_account_add(), since TTM_TT_FLAG_EXTERNAL is set\nwithout TTM_TT_FLAG_EXTERNAL_MAPPABLE. However, TTM core's\nttm_tt_populate() wrapper unconditionally marks the tt as populated\non driver-hook success, so ttm_tt_is_populated() still reports true\nfor it. xe_bo_account_pin()/xe_bo_account_unpin() trusted\nttm_tt_is_populated() as a proxy for \"these pages are accounted for\nby the shrinker\", and would subtract/add pages for such a tt that\nwere never added in the first place, again underflowing the\nshrinker's counts. This is reachable today via xe_bo_pin_external(),\nand would have become newly reachable via the fb-pin path once this\npatch routes __xe_pin_fb_vma() through xe_bo_pin_account() below, so\nfix it here rather than in a later patch, to avoid a commit in this\nseries that introduces the regression before fixing it. Skip the\naccounting for imported bos, using the same EXTERNAL &&\n!EXTERNAL_MAPPABLE test xe_ttm_tt_populate()/xe_ttm_tt_unpopulate()\nuse to decide whether to act, via a new xe_ttm_bo_is_imported()\nhelper (hoisted up from its only prior use site).\n\nv2:\n- Fix the critical issue caught by Sashiko AI review: the pin-count\n  transition check introduced here was still bypassed by the fb-pin\n  path (__xe_pin_fb_vma()/__xe_unpin_fb_vma()), which could leave a\n  stale pinned_link entry and a permanent shrinker accounting leak\n  when the fb-unpin performed the true last unpin. Addressed in a\n  separate follow-up patch in this series rather than folded in here,\n  since it is a distinct bug with its own Fixes: tag.\n- Drop the unneeded local \"last_unpin\" variable in\n  xe_bo_unpin_external(), restoring the original inline\n  bo->ttm.pin_count == 1 check; it was a no-op rename not used by any\n  of the new accounting helpers, and was going to be deleted again by\n  the follow-up patch anyway.\n\nv3:\n- Exclude imported dma-bufs from the pin/unpin shrinker accounting,\n  fixing another underflow caught by Sashiko AI review.\n- Add a short comment on the backup-object pin site noting it's\n  already populated/accounted at pin time, addressing (as a\n  false-positive clarification, no code fix needed) a separate\n  Medium-severity accounting-leak concern also caught by Sashiko AI\n  \n---truncated---","state":0,"publishedAt":"2026-10-23T12:20:20.753+00:00","modifiedAt":"2026-10-23T12:20:20.753+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/gpu/drm/xe/display/xe_fb_pin.c\",\n                        \"drivers/gpu/drm/xe/xe_bo.c\",\n                        \"drivers/gpu/drm/xe/xe_bo.h\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"00c8efc3180f0cf919b53980e969430657e01685\",\n                            \"lessThan\": \"993c952e6832ad0aa4be82e11f0760b1f532090a\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"00c8efc3180f0cf919b53980e969430657e01685\",\n                            \"lessThan\": \"ab39bc55cf08208b8511b1c09926b1b646a8befc\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"00c8efc3180f0cf919b53980e969430657e01685\",\n                            \"lessThan\": \"83d5acca1f4f6132038ea88c72c5844f62e42d44\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/gpu/drm/xe/display/xe_fb_pin.c\",\n                        \"drivers/gpu/drm/xe/xe_bo.c\",\n                        \"drivers/gpu/drm/xe/xe_bo.h\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"6.15\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"6.15\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.57\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.11\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/993c952e6832ad0aa4be82e11f0760b1f532090a","https://git.kernel.org/stable/c/ab39bc55cf08208b8511b1c09926b1b646a8befc","https://git.kernel.org/stable/c/83d5acca1f4f6132038ea88c72c5844f62e42d44"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-99000","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-99000","identifiers":["CVE-2026-99000"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-10-27T23:49:11.7604642+00:00","complete":true,"records":1760,"lastAttemptAt":"2026-10-27T23:49:11.7604642+00:00","lastSuccessAt":"2026-10-27T23:49:11.9251984+00:00","error":null,"lastVerifiedAt":"2026-10-27T23:49:11.9252004+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-187d2b72c94ceb8c4417f1032ec3109a3a3a7b730abadb561d8cdd2a96e04d27-6f8284a2c5d6f7a90df031c58649fd65623df7f48801e0993675b394053cb25f","complete":true,"records":415414,"lastAttemptAt":"2026-10-27T23:46:16.5712996+00:00","lastSuccessAt":"2026-10-27T23:46:16.4250984+00:00","error":null,"lastVerifiedAt":"2026-10-27T23:46:16.5712996+00:00","snapshotPublishedAt":"2026-10-27T23:26:27+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-2e31ad7d92d64caab0469a906a9524b8","complete":false,"records":7721,"lastAttemptAt":"2026-10-28T00:01:24.1583332+00:00","lastSuccessAt":"2026-10-28T00:01:24.154+00:00","error":"7 identifier lookups failed; latest failures include HTTP 403. Other identifiers were checked independently.","lastVerifiedAt":"2026-10-28T00:01:24.154+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":2993,"expectedIdentifiers":13514,"failedIdentifiers":7},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-10-27T23:49:11.7604642+00:00","complete":true,"records":1093,"lastAttemptAt":"2026-10-27T23:49:11.7604642+00:00","lastSuccessAt":"2026-10-27T23:49:11.9264383+00:00","error":null,"lastVerifiedAt":"2026-10-27T23:49:11.9264386+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-8d16a738328646698f9217d8ea11893c","complete":true,"records":13449,"lastAttemptAt":"2026-10-27T23:49:12.4732058+00:00","lastSuccessAt":"2026-10-27T22:48:29.491+00:00","error":null,"lastVerifiedAt":"2026-10-27T22:48:29.491+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13514,"expectedIdentifiers":13514,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-f7cb12508d9e6a348c8a60f772ed85529cc80cd2ff853da1099b57754b20e943","complete":true,"records":9790,"lastAttemptAt":"2026-10-27T23:49:11.6141417+00:00","lastSuccessAt":"2026-10-27T21:49:03.9756799+00:00","error":null,"lastVerifiedAt":"2026-10-27T23:49:11.6141417+00:00","snapshotPublishedAt":"2026-10-27T21:48:11+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-72e5e79de0026dd0562d40734074a2236a06886643d67182b8381eaee757dbf7","complete":true,"records":1966,"lastAttemptAt":"2026-10-27T23:46:16.7294886+00:00","lastSuccessAt":"2026-10-27T21:46:38.0277323+00:00","error":null,"lastVerifiedAt":"2026-10-27T23:46:16.7294886+00:00","snapshotPublishedAt":"2026-10-27T21:18:15+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-3a5b306d60fc44677a03a8afc99d87e6c5402770ef68d560f94a8c3ad3802b75","complete":true,"records":3001,"lastAttemptAt":"2026-10-27T23:49:11.7203646+00:00","lastSuccessAt":"2026-10-27T16:45:49.0050993+00:00","error":null,"lastVerifiedAt":"2026-10-27T23:49:11.7203646+00:00","snapshotPublishedAt":"2026-10-27T16:33:43+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-e94506f133c8bd17d5821d183faeaf30a6e2cec4fbbffe29e073cb827f4fb210","complete":true,"records":230853,"lastAttemptAt":"2026-10-27T23:49:11.4810073+00:00","lastSuccessAt":"2026-10-27T23:49:10.0217006+00:00","error":null,"lastVerifiedAt":"2026-10-27T23:49:11.4810073+00:00","snapshotPublishedAt":"2026-10-27T23:33:11+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}