In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix shrinker accounting double-subtraction on nested external pins… (CVE-2026-99000)

The Linux kernel's drm/xe subsystem mishandled shrinker accounting for nested external pins on buffer objects (BOs). Functions xe_bo_pin_external() and xe_bo_unpin_external() support nested pins, but the accounting calls xe_ttm_tt_account_subtract() and xe_ttm_tt_account_add() were invoked unconditionally on every pin/unpin, rather than only on transitions into and out of the pinned state. This caused the shrinker's page and object counts to become desynchronized, potentially underflowing and resulting in an erroneously large shrinkable page count. Additionally, imported dma-bufs were improperly accounted for, causing further underflows. The fix involved guarding accounting calls with pin-count transition checks and excluding imported dma-bufs from accounting, centralizing logic in xe_bo_account_pin() and xe_bo_account_unpin().

The vulnerability causes the shrinker's page and object counts to become inaccurate, potentially underflowing and leading to excessive shrinker invocation under memory pressure. This can degrade system performance due to unnecessary memory reclaim activity. There is no indication of direct memory corruption or privilege escalation. No known exploits in the wild have been reported.

A fix has been implemented in the Linux kernel drm/xe subsystem to correctly handle shrinker accounting by updating counts only on pin-count transitions and excluding imported dma-bufs from accounting. Users should update to a kernel version that includes this fix once available. Patch status is not explicitly confirmed in the provided data; check the vendor advisory or Linux kernel mailing lists for the official fixed version and apply the update accordingly.