Cloudanix VulnDB

CVE-2026-99145

None

CVSS

—

EPSS

0.2%

Published

Oct 28, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in how the operating system tracks graphics memory on certain Intel chips can cause memory counts to become wrong, potentially slowing down or destabilizing the computer.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Other
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Incorrect accounting of shrinkable and purgeable page counts for pinned buffer objects in the Xe graphics driver when purgeable state changes after pinning, causing underflow in one count and permanent inflation in the other after unpin.

Why it matters to the business

Systems using affected Intel graphics hardware may experience memory management errors leading to performance degradation, excessive swapping, or system instability until the kernel is updated.

How an attack unfolds

A local attacker triggers a purgeable state change on a pinned buffer object (for example via madvise DONTNEED on a scanout buffer) to induce the accounting error; repeated triggering can leave page counts in an inconsistent state that affects kernel shrinker behavior after the object is unpinned.

How to fix it

Update the Linux kernel to a version containing the fix from commit afe6bc012034123fd838328668e609bf57e46bd3; rebuild and deploy the patched kernel image on all affected systems.

How to confirm the fix worked

Confirm the presence of the fix commit in the running kernel source or binary; test by pinning a buffer object, changing its purgeable state, unpinning, and verifying that shrinker counts remain balanced.

Typical attack path

  1. Obtain local unprivileged access on a system with the vulnerable Xe driver
  2. Pin a buffer object used as a scanout buffer
  3. Change its purgeable state while pinned
  4. Unpin the object to leave inflated or underflowed shrinker counts
  5. Repeat to degrade memory accounting over time

How to detect it

Examine kernel logs for Xe driver warnings or shrinker-related underflow messages; review system call traces involving madvise and buffer object pinning operations around the time of any graphics-related instability.

What your security team should do

  • Prioritize kernel updates on all systems with Intel Xe graphics within the next patch cycle
  • Monitor upstream stable kernel releases for backports of the fix
  • Review graphics driver usage in container or virtualized environments for additional exposure

The record

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Don't transfer shrinker pages for pinned bos on purgeable state change Pinned bos have their pages removed from the shrinker's shrinkable / purgeable counts on pin, and added back on unpin according to the bo's purgeable state at that time. However, xe_bo_set_purgeable_shrinker() unconditionally transfers pages between the shrinkable and purgeable counts. If the purgeable state of a pinned bo changes, for example by userspace madvising DONTNEED on a VMA of a bo that is also pinned as a scanout buffer, this underflows one count and, after unpin, leaves the other one permanently inflated. Only update the purgeable flag for pinned bos, and leave the page accounting to unpin. (cherry picked from commit afe6bc012034123fd838328668e609bf57e46bd3)

Affected packages

Ecosystem Package Introduced Fixed