CVE-2026-99145 drm/xe: Don't transfer shrinker pages for pinned bos on purgeable state change
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-99145?
CVE-2026-99145 is a vulnerability in Linux, published on 28 Oct 2026.
Official description
In the Linux kernel, the following vulnerability has been resolved:
drm/xe: Don't transfer shrinker pages for pinned bos on purgeable state change
Pinned bos have their pages removed from the shrinker's shrinkable / purgeable counts on pin, and added back on unpin according to the bo's purgeable state at that time.
However, xe_bo_set_purgeable_shrinker() unconditionally transfers pages between the shrinkable and purgeable counts. If the purgeable state of a pinned bo changes, for example by userspace madvising DONTNEED on a VMA of a bo that is also pinned as a scanout buffer, this underflows one count and, after unpin, leaves the other one permanently inflated.
Only update the purgeable flag for pinned bos, and leave the page accounting to unpin.
(cherry picked from commit afe6bc012034123fd838328668e609bf57e46bd3)
Which versions are affected by CVE-2026-99145?
How do I fix CVE-2026-99145?
Upgrade to a fixed version.
Is CVE-2026-99145 being exploited?
There is no known exploitation of CVE-2026-99145 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-99145, GHSA-f7m7-cgc5-xpx5, UBUNTU-CVE-2026-99145.