DEBIAN-CVE-2026-99145: Debian/linux vulnerability

Published Oct 28, 2026

Updated

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Don't transfer shrinker pages for pinned bos on purgeable state change Pinned bos have their pages removed from the shrinker's shrinkable / purgeable counts on pin, and added back on unpin according to the bo's purgeable state at that time. However, xebosetpurgeableshrinker() unconditionally transfers pages between the shrinkable and purgeable counts. If the purgeable state of a pinned bo changes, for example by userspace madvising DONTNEED on a VMA of a bo that is also pinned as a scanout buffer, this underflows one count and, after unpin, leaves the other one permanently inflated. Only update the purgeable flag for pinned bos, and leave the page accounting to unpin. (cherry picked from commit afe6bc012034123fd838328668e609bf57e46bd3)

Affected Software

1 affected component

debian/linux*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Linux kernel drm/xe to a version that resolves this vulnerability.
Patch afe6bc012034123fd838328668e609bf57e46bd3

Event History

Oct 28, 2026

CVE Published

via OSV·11:17 AM

Data Sourced

via OSV·11:17 AM

DescriptionAffected Software

Frequently Asked Questions

What conditions are required to trigger the accounting error?

A buffer object must be pinned and have its purgeable state changed while pinned. The described example is userspace issuing MADV_DONTNEED on a VMA for a buffer object that is also pinned as a scanout buffer.

Which systems are realistically exposed?

Systems using the Linux kernel's drm/xe driver are relevant. The issue specifically involves pinned buffer objects whose purgeable state is changed, rather than ordinary buffer-object use alone.

What is the effect of triggering the issue?

Changing the purgeable state of a pinned buffer object can underflow one shrinker accounting count. After the object is unpinned, the other count can remain permanently inflated.

Is there a configuration-only workaround if patching is not immediately possible?

The provided information does not identify a configuration workaround. Avoiding purgeable-state changes, such as MADV_DONTNEED, for buffer objects while they remain pinned would avoid the described trigger condition.

DEBIAN-CVE-2026-99145: Debian/linux vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

What conditions are required to trigger the accounting error?

Which systems are realistically exposed?

What is the effect of triggering the issue?

Is there a configuration-only workaround if patching is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

What conditions are required to trigger the accounting error?

Which systems are realistically exposed?

What is the effect of triggering the issue?

Is there a configuration-only workaround if patching is not immediately possible?