Integer underflow in Linux kernel - CVE-2026-99000

Vulnerability identifier: #VU157503

CSH Severity: Low

CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-99000

CWE-ID: CWE-191

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to corrupt memory-reclamation accounting and potentially cause a denial of service under memory pressure.

The vulnerability exists due to accounting underflow in the Linux kernel Xe driver's buffer-object pin accounting when processing imported dma-bufs whose translation tables are marked populated but whose pages were never included in shrinker accounting. A local user can trigger external pinning of such an imported buffer to subtract pages that were never counted, producing negative counts that are interpreted as enormous unsigned reclaimable page counts and potentially causing a denial of service through excessive shrinker activity.

The affected imported translation tables have TTM_TT_FLAG_EXTERNAL set without TTM_TT_FLAG_EXTERNAL_MAPPABLE.

Linux kernel
Ubuntu
linux (Ubuntu package)
linux-realtime (Ubuntu package)
linux-oracle (Ubuntu package)
linux-aws (Ubuntu package)
linux-gcp (Ubuntu package)
linux-azure (Ubuntu package)
linux-raspi (Ubuntu package)
linux-ibm (Ubuntu package)
linux-oracle-7.0 (Ubuntu package)
linux-gcp-7.0 (Ubuntu package)
linux-azure-fde-7.0 (Ubuntu package)
linux-oem-7.0 (Ubuntu package)
linux-gke (Ubuntu package)
linux-azure-fde (Ubuntu package)
linux-aws-7.0 (Ubuntu package)

Install security update from vendor's repository.

Linux kernel - update to 7.0 rc3
linux (Ubuntu package) - update to 7.0.0-43.43
linux-realtime (Ubuntu package) - update to 7.0.0-43.43.1
linux-oracle (Ubuntu package) - update to 7.0.0-1016.18
linux-aws (Ubuntu package) - update to 7.0.0-1017.18
linux-gcp (Ubuntu package) - update to 7.0.0-1017.19
linux-azure (Ubuntu package) - update to 7.0.0-1020.21
linux-raspi (Ubuntu package) - update to 7.0.0-1023.23
linux-ibm (Ubuntu package) - update to 7.0.0-1018.18
linux-oracle-7.0 (Ubuntu package) - update to 7.0.0-1016.18~24.04.1
linux-gcp-7.0 (Ubuntu package) - update to 7.0.0-1017.19~24.04.1
linux-azure-fde-7.0 (Ubuntu package) - update to 7.0.0-1019.19~24.04.1
linux-oem-7.0 (Ubuntu package) - update to 7.0.0-1018.18
linux-gke (Ubuntu package) - update to 7.0.0-1010.11
linux-azure-fde (Ubuntu package) - update to 7.0.0-1019.19
linux-aws-7.0 (Ubuntu package) - update to 7.0.0-1017.18~24.04.1

• https://git.kernel.org/stable/c/83d5acca1f4f6132038ea88c72c5844f62e42d44
• https://git.kernel.org/stable/c/993c952e6832ad0aa4be82e11f0760b1f532090a
• https://git.kernel.org/stable/c/ab39bc55cf08208b8511b1c09926b1b646a8befc

• Integer underflow in Linux kernel drm xe driver
• Ubuntu update for linux, linux-aws, linux-gcp and more
• Ubuntu update for linux-azure
• Ubuntu update for linux-aws-7.0, linux-azure-fde, linux-azure-fde-7.0 and more
• Ubuntu update for linux-raspi