---
id: "CVE-2026-99145"
kind: "vulnerability"
aliases: ["CVE-2026-99145"]
title: "Linux kernel: Intel Xe GPU driver shrinker accounting underflows on purgeable change"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["drm", "intel-xe", "linux-kernel", "runtime"]
not_affected_if: ["no-intel-xe-gpu"]
published_at: "2026-10-28T11:17:34+00:00"
first_seen_at: "2026-10-28T11:32:35+00:00"
updated_at: "2026-10-28T11:36:04+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-99145", "first_seen_at": "2026-10-28T11:32:35+00:00"}]
---

# Linux kernel: Intel Xe GPU driver shrinker accounting underflows on purgeable change

In the Linux kernel's Xe DRM driver, changing the purgeable state of a pinned buffer object, such as by madvising DONTNEED on a mapping of a scanout buffer, moves pages between shrinker counts incorrectly. The result is a count underflow and a permanently inflated count after unpin, which the sources do not show leads to code execution or data exposure.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- `uname -r` and compare against the fixed kernel builds listed in the NVD record (unknown from these sources)
- Check whether the `xe` DRM driver is loaded with `lsmod | grep xe` on systems with Intel Xe GPUs
- unknown for other checks: the sources do not say how to test pinned scanout buffers in practice

## Fix

- Update the Linux kernel to a release that includes upstream commit `afe6bc012034123fd838328668e609bf57e46bd3` (exact version unknown from these sources)
- Apply the stable-branch backport of the same commit if running a distribution kernel

## Timeline

- 2026-10-28T11:32:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-99145

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

drm/xe: Don't transfer shrinker pages for pinned bos on purgeable state change

Pinned bos have their pages removed from the shrinker's shrinkable /
purgeable counts on pin, and added back on unpin according to the
bo's purgeable state at that time.

However, xe_bo_set_purgeable_shrinker() unconditionally transfers
pages between the shrinkable and purgeable counts. If the purgeable
state of a pinned bo changes, for example by userspace madvising
DONTNEED on a VMA of a bo that is also pinned as a scanout buffer,
this underflows one count and, after unpin, leaves the other one
permanently inflated.

Only update the purgeable flag for pinned bos, and leave the page
accounting to unpin.

(cherry picked from commit afe6bc012034123fd838328668e609bf57e46bd3)

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_