CVE-2026-99000

In the Linux kernel, the following vulnerability has been resolved:

drm/xe: Fix shrinker accounting double-subtraction on nested external pins

xe bo pin external() and xe bo unpin external() support nested pins, since the underlying ttm bo pin()/ttm bo unpin() maintain a pin count refcount rather than a boolean. However, the shrinker accounting calls xe ttm tt account subtract() and xe ttm tt account add() are invoked unconditionally on every pin external()/unpin external() call, instead of only on the transition into and out of the pinned state.

An external BO (dma-buf) can be pinned more than once while already pinned, for example when it has multiple attachments/importers, each independently calling xe bo pin external(). Each such nested pin subtracts the BO's pages from the shrinker's accounting again, even though the BO's pages were already removed from consideration by the first pin. Symmetrically, each nested unpin adds them back again before the BO is actually unpinned. This desynchronizes the shrinker's page and object counts from reality, and since they are declared as signed long but interpreted as unsigned long in xe shrinker count(), the underflow can turn into an enormous shrinkable/purgeable page count, causing the shrinker to be invoked excessively under memory pressure.

Guard the accounting calls with the same pin-count transition checks already used to guard the pinned link list maintenance, so accounting is only updated on the outermost pin and the final unpin.

While centralizing this logic into xe bo account pin()/ xe bo account unpin(), also close a second, related accounting gap affecting imported dma-bufs. For an imported bo's ttm tt, xe's ttm tt populate hook (xe ttm tt populate()) early-returns without calling xe ttm tt account add(), since TTM TT FLAG EXTERNAL is set without TTM TT FLAG EXTERNAL MAPPABLE. However, TTM core's ttm tt populate() wrapper unconditionally marks the tt as populated on driver-hook success, so ttm tt is populated() still reports true for it. xe bo account pin()/xe bo account unpin() trusted ttm tt is populated() as a proxy for "these pages are accounted for by the shrinker", and would subtract/add pages for such a tt that were never added in the first place, again underflowing the shrinker's counts. This is reachable today via xe bo pin external(), and would have become newly reachable via the fb-pin path once this patch routes xe pin fb vma() through xe bo pin account() below, so fix it here rather than in a later patch, to avoid a commit in this series that introduces the regression before fixing it. Skip the accounting for imported bos, using the same EXTERNAL && !EXTERNAL MAPPABLE test xe ttm tt populate()/xe ttm tt unpopulate() use to decide whether to act, via a new xe ttm bo is imported() helper (hoisted up from its only prior use site).

v2:

v3:

---truncated---