CVE-2026-99145

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-99145", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.396Z", "datePublished": "2026-10-28T10:35:02.038Z", "dateUpdated": "2026-10-28T10:35:02.038Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-28T10:35:02.038Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe: Don't transfer shrinker pages for pinned bos on purgeable state change\n\nPinned bos have their pages removed from the shrinker's shrinkable /\npurgeable counts on pin, and added back on unpin according to the\nbo's purgeable state at that time.\n\nHowever, xe_bo_set_purgeable_shrinker() unconditionally transfers\npages between the shrinkable and purgeable counts. If the purgeable\nstate of a pinned bo changes, for example by userspace madvising\nDONTNEED on a VMA of a bo that is also pinned as a scanout buffer,\nthis underflows one count and, after unpin, leaves the other one\npermanently inflated.\n\nOnly update the purgeable flag for pinned bos, and leave the page\naccounting to unpin.\n\n(cherry picked from commit afe6bc012034123fd838328668e609bf57e46bd3)"}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/xe/xe_bo.c"], "versions": [{"version": "536a2ead3a8f2048643da3e8340a4d73fdf71903", "lessThan": "135e998dd1e66b8854db7bd356b6563baf8b9d51", "status": "affected", "versionType": "git"}, {"version": "536a2ead3a8f2048643da3e8340a4d73fdf71903", "lessThan": "ffbfd3f98f4393e91dffce3a46ccb7cf5329cf2f", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/xe/xe_bo.c"], "versions": [{"version": "7.1", "status": "affected"}, {"version": "0", "lessThan": "7.1", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.13", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.1", "versionEndExcluding": "7.2.13"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.1", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/135e998dd1e66b8854db7bd356b6563baf8b9d51"}, {"url": "https://git.kernel.org/stable/c/ffbfd3f98f4393e91dffce3a46ccb7cf5329cf2f"}], "title": "drm/xe: Don't transfer shrinker pages for pinned bos on purgeable state change", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/gpu/drm/xe/xe_bo.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "135e998dd1e66b8854db7bd356b6563baf8b9d51", "status": "affected", "version": "536a2ead3a8f2048643da3e8340a4d73fdf71903", "versionType": "git"}, {"lessThan": "ffbfd3f98f4393e91dffce3a46ccb7cf5329cf2f", "status": "affected", "version": "536a2ead3a8f2048643da3e8340a4d73fdf71903", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/gpu/drm/xe/xe_bo.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "7.1"}, {"lessThan": "7.1", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.13", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe: Don't transfer shrinker pages for pinned bos on purgeable state change\n\nPinned bos have their pages removed from the shrinker's shrinkable /\npurgeable counts on pin, and added back on unpin according to the\nbo's purgeable state at that time.\n\nHowever, xe_bo_set_purgeable_shrinker() unconditionally transfers\npages between the shrinkable and purgeable counts. If the purgeable\nstate of a pinned bo changes, for example by userspace madvising\nDONTNEED on a VMA of a bo that is also pinned as a scanout buffer,\nthis underflows one count and, after unpin, leaves the other one\npermanently inflated.\n\nOnly update the purgeable flag for pinned bos, and leave the page\naccounting to unpin.\n\n(cherry picked from commit afe6bc012034123fd838328668e609bf57e46bd3)"}], "id": "CVE-2026-99145", "lastModified": "2026-10-28T11:17:34.547", "metrics": {}, "published": "2026-10-28T11:17:34.547", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/135e998dd1e66b8854db7bd356b6563baf8b9d51"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ffbfd3f98f4393e91dffce3a46ccb7cf5329cf2f"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: kernel: Denial of Service via improper page accounting in drm/xe", "id": "2562657", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2562657"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-191", "details": ["In the Linux kernel, the following vulnerability has been resolved:\ndrm/xe: Don't transfer shrinker pages for pinned bos on purgeable state change\nPinned bos have their pages removed from the shrinker's shrinkable /\npurgeable counts on pin, and added back on unpin according to the\nbo's purgeable state at that time.\nHowever, xe_bo_set_purgeable_shrinker() unconditionally transfers\npages between the shrinkable and purgeable counts. If the purgeable\nstate of a pinned bo changes, for example by userspace madvising\nDONTNEED on a VMA of a bo that is also pinned as a scanout buffer,\nthis underflows one count and, after unpin, leaves the other one\npermanently inflated.\nOnly update the purgeable flag for pinned bos, and leave the page\naccounting to unpin.\n(cherry picked from commit afe6bc012034123fd838328668e609bf57e46bd3)", "A flaw was found in the Linux kernel's Intel Xe graphics driver (drm/xe). A local user could exploit this vulnerability by altering the memory state of a pinned graphics buffer object, causing the driver to unconditionally transfer pages between memory tracking pools. This issue triggers an integer underflow and corrupted memory accounting in the kernel shrinker, which may lead to system instability or a Denial of Service (DoS)."], "name": "CVE-2026-99145", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-28T10:35:02Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-99145\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-99145\nhttps://git.kernel.org/stable/c/135e998dd1e66b8854db7bd356b6563baf8b9d51\nhttps://git.kernel.org/stable/c/ffbfd3f98f4393e91dffce3a46ccb7cf5329cf2f"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[536a2ead3a8f2048643da3e8340a4d73fdf71903,135e998dd1e66b8854db7bd356b6563baf8b9d51)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[536a2ead3a8f2048643da3e8340a4d73fdf71903,ffbfd3f98f4393e91dffce3a46ccb7cf5329cf2f)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.1"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,7.1)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.13,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[536a2ead3a8f2048643da3e8340a4d73fdf71903,135e998dd1e66b8854db7bd356b6563baf8b9d51)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[536a2ead3a8f2048643da3e8340a4d73fdf71903,ffbfd3f98f4393e91dffce3a46ccb7cf5329cf2f)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.1"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,7.1)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.13,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-28T12:45:16.181349+00:00", "updated": "2026-10-30T02:15:05.350175+00:00", "vendors": ["linux", "linux$PRODUCT$linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-191", "CWE-193"]}