{"id":"CVE-2026-99000","title":"drm/xe: Fix shrinker accounting double-subtraction on nested external pins","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe: Fix shrinker accounting double-subtraction on nested external pins\n\nxe_bo_pin_external() and xe_bo_unpin_external() support nested pins,\nsince the underlying tt…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 00c8efc3180f0cf919b53980e969430657e01685 < 993c952e6832ad0aa4be82e11f0760b1f532090a","Linux >= 00c8efc3180f0cf919b53980e969430657e01685 < ab39bc55cf08208b8511b1c09926b1b646a8befc","Linux >= 00c8efc3180f0cf919b53980e969430657e01685 < 83d5acca1f4f6132038ea88c72c5844f62e42d44","Linux 6.15"],"published":"2026-10-23","updated":"2026-10-23","sourceUpdated":"2026-10-23T12:20:20.753Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-99000","references":[{"url":"https://git.kernel.org/stable/c/993c952e6832ad0aa4be82e11f0760b1f532090a"},{"url":"https://git.kernel.org/stable/c/ab39bc55cf08208b8511b1c09926b1b646a8befc"},{"url":"https://git.kernel.org/stable/c/83d5acca1f4f6132038ea88c72c5844f62e42d44"}],"tags":["cve.org"],"ingestedAt":"2026-10-23T13:24:55.542Z","slug":"CVE-2026-99000","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe: Fix shrinker accounting double-subtraction on nested external pins\n\nxe_bo_pin_external() and xe_bo_unpin_external() support nested pins,\nsince the underlying ttm_bo_pin()/ttm_bo_unpin() maintain a pin_count\nrefcount rather than a boolean. However, the shrinker accounting calls\nxe_ttm_tt_account_subtract() and xe_ttm_tt_account_add() are invoked\nunconditionally on every pin_external()/unpin_external() call, instead\nof only on the transition into and out of the pinned state.\n\nAn external BO (dma-buf) can be pinned more than once while already\npinned, for example when it has multiple attachments/importers, each\nindependently calling xe_bo_pin_external(). Each such nested pin\nsubtracts the BO's pages from the shrinker's accounting again, even\nthough the BO's pages were already removed from consideration by the\nfirst pin. Symmetrically, each nested unpin adds them back again\nbefore the BO is actually unpinned. This desynchronizes the\nshrinker's page and object counts from reality, and since they are\ndeclared as signed long but interpreted as unsigned long in\nxe_shrinker_count(), the underflow can turn into an enormous\nshrinkable/purgeable page count, causing the shrinker to be invoked\nexcessively under memory pressure.\n\nGuard the accounting calls with the same pin-count transition checks\nalready used to guard the pinned_link list maintenance, so accounting\nis only updated on the outermost pin and the final unpin.\n\nWhile centralizing this logic into xe_bo_account_pin()/\nxe_bo_account_unpin(), also close a second, related accounting gap\naffecting imported dma-bufs. For an imported bo's ttm_tt, xe's\nttm_tt_populate hook (xe_ttm_tt_populate()) early-returns without\ncalling xe_ttm_tt_account_add(), since TTM_TT_FLAG_EXTERNAL is set\nwithout TTM_TT_FLAG_EXTERNAL_MAPPABLE. However, TTM core's\nttm_tt_populate() wrapper unconditionally marks the tt as populated\non driver-hook success, so ttm_tt_is_populated() still reports true\nfor it. xe_bo_account_pin()/xe_bo_account_unpin() trusted\nttm_tt_is_populated() as a proxy for \"these pages are accounted for\nby the shrinker\", and would subtract/add pages for such a tt that\nwere never added in the first place, again underflowing the\nshrinker's counts. This is reachable today via xe_bo_pin_external(),\nand would have become newly reachable via the fb-pin path once this\npatch routes __xe_pin_fb_vma() through xe_bo_pin_account() below, so\nfix it here rather than in a later patch, to avoid a commit in this\nseries that introduces the regression before fixing it. Skip the\naccounting for imported bos, using the same EXTERNAL &&\n!EXTERNAL_MAPPABLE test xe_ttm_tt_populate()/xe_ttm_tt_unpopulate()\nuse to decide whether to act, via a new xe_ttm_bo_is_imported()\nhelper (hoisted up from its only prior use site).\n\nv2:\n- Fix the critical issue caught by Sashiko AI review: the pin-count\n  transition check introduced here was still bypassed by the fb-pin\n  path (__xe_pin_fb_vma()/__xe_unpin_fb_vma()), which could leave a\n  stale pinned_link entry and a permanent shrinker accounting leak\n  when the fb-unpin performed the true last unpin. Addressed in a\n  separate follow-up patch in this series rather than folded in here,\n  since it is a distinct bug with its own Fixes: tag.\n- Drop the unneeded local \"last_unpin\" variable in\n  xe_bo_unpin_external(), restoring the original inline\n  bo->ttm.pin_count == 1 check; it was a no-op rename not used by any\n  of the new accounting helpers, and was going to be deleted again by\n  the follow-up patch anyway.\n\nv3:\n- Exclude imported dma-bufs from the pin/unpin shrinker accounting,\n  fixing another underflow caught by Sashiko AI review.\n- Add a short comment on the backup-object pin site noting it's\n  already populated/accounted at pin time, addressing (as a\n  false-positive clarification, no code fix needed) a separate\n  Medium-severity accounting-leak concern also caught by Sashiko AI\n  \n---truncated---\n\n## Affected\n\n- `Linux >= 00c8efc3180f0cf919b53980e969430657e01685 < 993c952e6832ad0aa4be82e11f0760b1f532090a`\n- `Linux >= 00c8efc3180f0cf919b53980e969430657e01685 < ab39bc55cf08208b8511b1c09926b1b646a8befc`\n- `Linux >= 00c8efc3180f0cf919b53980e969430657e01685 < 83d5acca1f4f6132038ea88c72c5844f62e42d44`\n- `Linux 6.15`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}