CVE-2026-98999

In the Linux kernel, the following vulnerability has been resolved:

drm/xe: Fix stale pinned link entry when fb-pin performs the final unpin

xe bo pin external() and xe bo unpin external() maintain the bo's pinned link list membership in xe->pinned.late.external, based on whether the current call is the outermost pin or the final unpin. However, the same external bo's pin count can also be raised and lowered directly by xe pin fb vma()/ xe unpin fb vma(), which pin the bo as a display scanout buffer without going through xe bo pin external()/xe bo unpin external() at all, and have no notion of, or ownership over, pinned link.

If a bo is pinned both externally (e.g. dma-buf export) and as an fb, and the external unpin happens first, xe bo unpin external() correctly observes pin count > 1 and leaves the bo on pinned link. When the fb unpin later performs the true last unpin (pin count 1 -> 0), it never touches pinned link, leaving the bo linked on xe->pinned.late.external indefinitely. Once the bo is subsequently freed, this stale list entry points into freed memory, corrupting the list and risking a use-after-free the next time the list is walked or spliced.

The backup object pin/unpin sites in xe bo notifier prepare pinned()/ xe bo notifier unprepare pinned() have the same bypass characteristic, though they never add their bo to a pinned list, so are not affected by this particular list-corruption issue.

Move the pinned link removal into xe bo account unpin(), which already runs on every unpin path (kernel, external, framebuffer, backup object) right before the true 1 -> 0 pin count transition. Since list del init() only operates on the node itself, this removal is list-agnostic and safe to perform regardless of which list (external or kernel bo present) the bo happens to be linked on, or which code path is performing the final unpin. Drop the now-redundant explicit list del init() calls in xe bo unpin external() and xe bo unpin().

v2:

v3:

(cherry picked from commit ca58d36a1f93af586ee93b340c9f9fd81312cc01)