SB20261023162 - Integer underflow in Linux kernel drm xe driver

Description

This security bulletin contains information about 1 vulnerability.

1) Integer underflow (CVE-ID: CVE-2026-99000)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to corrupt memory-reclamation accounting and potentially cause a denial of service under memory pressure.

The vulnerability exists due to accounting underflow in the Linux kernel Xe driver's buffer-object pin accounting when processing imported dma-bufs whose translation tables are marked populated but whose pages were never included in shrinker accounting. A local user can trigger external pinning of such an imported buffer to subtract pages that were never counted, producing negative counts that are interpreted as enormous unsigned reclaimable page counts and potentially causing a denial of service through excessive shrinker activity.

The affected imported translation tables have TTM_TT_FLAG_EXTERNAL set without TTM_TT_FLAG_EXTERNAL_MAPPABLE.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/83d5acca1f4f6132038ea88c72c5844f62e42d44
• https://git.kernel.org/stable/c/993c952e6832ad0aa4be82e11f0760b1f532090a
• https://git.kernel.org/stable/c/ab39bc55cf08208b8511b1c09926b1b646a8befc