SB20261023161 - Integer underflow in Linux kernel drm xe driver

Description

This security bulletin contains information about 1 vulnerability.

1) Integer underflow (CVE-ID: CVE-2026-99000)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause excessive memory-reclamation activity under memory pressure, potentially resulting in a denial of service.

The vulnerability exists due to accounting underflow in the Linux kernel Xe driver's xe_bo_pin_external() and xe_bo_unpin_external() functions when handling nested buffer-object pins. A local user can trigger multiple pins of the same external buffer object through multiple attachments or importers to repeatedly subtract already-excluded pages from the shrinker's accounting. Negative counts are interpreted as unsigned values, producing enormous apparent reclaimable page counts and potentially causing a denial of service through excessive shrinker activity.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/83d5acca1f4f6132038ea88c72c5844f62e42d44
• https://git.kernel.org/stable/c/993c952e6832ad0aa4be82e11f0760b1f532090a
• https://git.kernel.org/stable/c/ab39bc55cf08208b8511b1c09926b1b646a8befc