In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix stale pinned_link entry when fb-pin performs the final unpin… (CVE-2026-98999)

The vulnerability in the Linux kernel drm/xe subsystem involves improper management of the pinned_link list for buffer objects (bo). The functions xe_bo_pin_external() and xe_bo_unpin_external() maintain the pinned_link list based on pin counts, but framebuffer pin/unpin operations (__xe_pin_fb_vma()/__xe_unpin_fb_vma()) bypass this list management. When a bo is pinned both externally and as a framebuffer, an external unpin followed by a framebuffer unpin can leave a stale pinned_link entry pointing to freed memory. This stale entry can corrupt the list and cause use-after-free errors when the list is accessed. The fix moves the pinned_link removal to xe_bo_account_unpin(), which runs on every unpin path and safely removes the list entry at the true last unpin transition, preventing stale entries regardless of the pinning path.

The vulnerability can cause use-after-free conditions and memory corruption in the Linux kernel drm/xe subsystem when buffer objects are pinned and unpinned through different code paths. This could potentially lead to kernel instability or crashes. No known exploits in the wild have been reported.

A fix has been implemented in the Linux kernel to address this issue by moving the pinned_link removal to a common unpin function that handles all unpin paths safely. Users should apply the official kernel update containing this patch to remediate the vulnerability. Patch status is not yet confirmed in the provided data; check the vendor advisory for current remediation guidance.