All vulnerabilities
CVE-2026-99145

Linux: drm/xe: Don't transfer shrinker pages for pinned bos on purgeable state change

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in135e998dd1e66b8854db7bd356b6563baf8b9d51Fixed versionCVE List
Published28 Oct 2026Updated 28 Oct 2026CVE List

What fixes it

  • 135e998dd1e66b8854db7bd356b6563baf8b9d51LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

drm/xe: Don't transfer shrinker pages for pinned bos on purgeable state change

Pinned bos have their pages removed from the shrinker's shrinkable / purgeable counts on pin, and added back on unpin according to the bo's purgeable state at that time.

However, xe_bo_set_purgeable_shrinker() unconditionally transfers pages between the shrinkable and purgeable counts. If the purgeable state of a pinned bo changes, for example by userspace madvising DONTNEED on a VMA of a bo that is also pinned as a scanout buffer, this underflows one count and, after unpin, leaves the other one permanently inflated.

Only update the purgeable flag for pinned bos, and leave the page accounting to unpin.

(cherry picked from commit afe6bc012034123fd838328668e609bf57e46bd3)

Text from CVE List

Affected versions 6

  • Linuxaffected: 536a2ead3a8f2048643da3e8340a4d73fdf71903 before 135e998dd1e66b8854db7bd356b6563baf8b9d51CVE List
  • Linuxaffected: 536a2ead3a8f2048643da3e8340a4d73fdf71903 before ffbfd3f98f4393e91dffce3a46ccb7cf5329cf2fCVE List
  • Linuxaffected: 7.1CVE List
  • Linuxunaffected: all versions before 7.1CVE List
  • Linuxunaffected: 7.2.13 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 2