Live › vulnerability › CVE-2026-99145
Go to dashboardIn the Linux kernel's Xe DRM driver, changing the purgeable state of a pinned buffer object, such as by madvising DONTNEED on a mapping of a scanout buffer, moves pages between shrinker counts incorrectly. The result is a count underflow and a permanently inflated count after unpin, which the sources do not show leads to code execution or data exposure.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 11:32 UTC. All times on this page are UTC.
Systems running a Linux kernel with the Intel Xe DRM driver, where userspace can mark a buffer object as purgeable while it is pinned, for example as a scanout buffer. The sources do not describe the exposure beyond kernel memory accounting, so machines without Intel Xe GPUs are likely unaffected.
No product ranges from the sources yet.
uname -r and compare against the fixed kernel builds listed in the NVD record (unknown from these sources)xe DRM driver is loaded with lsmod | grep xe on systems with Intel Xe GPUsafe6bc012034123fd838328668e609bf57e46bd3 (exact version unknown from these sources)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
drm/xe: Don't transfer shrinker pages for pinned bos on purgeable state change
Pinned bos have their pages removed from the shrinker's shrinkable / purgeable counts on pin, and added back on unpin according to the bo's purgeable state at that time.
However, xe_bo_set_purgeable_shrinker() unconditionally transfers pages between the shrinkable and purgeable counts. If the purgeable state of a pinned bo changes, for example by userspace madvising DONTNEED on a VMA of a bo that is also pinned as a scanout buffer, this underflows one count and, after unpin, leaves the other one permanently inflated.
Only update the purgeable flag for pinned bos, and leave the page accounting to unpin.
(cherry picked from commit afe6bc012034123fd838328668e609bf57e46bd3)
This page as .md · .json · in your agent: get_signal("CVE-2026-99145")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.