{"metadata": {"vulnerability": "CVE-2026-99000", "count": 18, "kinds": {"milestone": 7, "sighting": 1, "kev": 0, "other": 10}}, "data": [{"timestamp": "2026-09-25T10:25:14.385Z", "date_only": false, "value": "2026-09-25T10:25:14.385Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-99000", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-23T12:20:20.753Z", "date_only": false, "value": "2026-10-23T12:20:20.753Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-99000", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-23T12:20:20.753Z", "date_only": false, "value": "2026-10-23T12:20:20.753Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-99000", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-23T12:20:20.753Z", "date_only": false, "value": "2026-10-23T12:20:20.753Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / Linux", "record": "CVE-2026-99000", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-23T13:17:00Z", "date_only": false, "value": "2026-10-23T13:17:00Z", "kind": "milestone", "label": "Published", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-99000", "record": "UBUNTU-CVE-2026-99000", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-23T13:17:22Z", "date_only": false, "value": "2026-10-23T13:17:22Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-M59J-MHQW-68MX", "record": "GHSA-M59J-MHQW-68MX", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-10-23T13:17:22.297Z", "date_only": false, "value": "2026-10-23T13:17:22.297", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-99000", "record": "FKIE_CVE-2026-99000", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-23T13:17:22.297Z", "date_only": false, "value": "2026-10-23T13:17:22.297", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-99000", "record": "FKIE_CVE-2026-99000", "field": "lastModified", "linked_record": true}, {"timestamp": "2026-10-23T13:40:08.977Z", "date_only": false, "value": "2026-10-23T13:40:08.977206Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117490503415916757", "record": "CVE-2026-99000", "field": "creation_timestamp", "uuid": "f2cbeca0-09f8-4250-8fc9-50f2cfc49777", "content": "CVE-2026-99000 drm/xe: Fix shrinker accounting double-subtraction on nested external pins In the Linux kernel, the following vulnerability has been resolved:\ndrm/xe: Fix shrinker accounting double-subtraction on nested external pins\nxe_bo_pin_external() and xe_bo_unpin_external() support nested pins,since the underlying ttm_bo_pin()/ttm_bo_unpin() maintain a pin_countrefcount rather than a boolean. However, the shrinker accounting callsxe_ttm_tt_account_subtract() and xe_ttm_tt_account_add() are invokedunconditionally on every pin_external()/unpin_external() call, insteadof only on the transition into and out of the pinned state.\nAn external BO (dma-buf) can be pinned more than once while alreadypinned, for example when it has multiple attachments/importers, eachindependently calling xe_bo_pin_external(). Each such nested pinsubtracts the BO's pages from the shrinker's accounting again, eventhough the BO's pages were already removed from consideration by thefirst pin. Symmetrically, each nested unpin adds them back againbefore the BO is actually unpinned. This desynchronizes theshrinker's page and object counts from reality, and since they aredeclared as signed long but interpreted as unsigned long inxe_shrinker_count(), the underflow can turn into an enormousshrinkable/purgeable page count, causing the shrinker to be invokedexcessively under memory pressure.\nGuard the accounting calls with the same pin-count transition checksalready used to guard the pinned_link list maintenance, so accountingis only updated on the outermost pin and the final unpin.\nWhile centralizing this logic into xe_bo_account_pin()/xe_bo_account_unpin(), also close a second, related accounting gapaffecting imported dma-bufs. For an imported bo's ttm_tt, xe'sttm_tt_populate hook (xe_ttm_tt_populate()) early-returns withoutcalling xe_ttm_tt_account_add(), since TTM_TT_FLAG_EXTERNAL is setwithout TTM_TT_FLAG_EXTERNAL_MAPPABLE. However, TTM core'sttm_tt_populate() wrapper unconditionally marks the tt as populatedon driver-hook success, so ttm_tt_is_populated() still reports truefor it. xe_bo_account_pin()/xe_bo_account_unpin() trustedttm_tt_is_populated() as a proxy for \"these pages are accounted forby the shrinker\", and would subtract/add pages for such a tt thatwere never added in the first place, again underflowing theshrinker's counts. This is reachable today via xe_bo_pin_external(),and would have become newly reachable via the fb-pin path once thispatch routes __xe_pin_fb_vma() through xe_bo_pin_account() below, sofix it here rather than in a later patch, to avoid a commit in thisseries that introduces the regression before fixing it. Skip theaccounting for imported bos, using the same EXTERNAL &&!EXTERNAL_MAPPABLE test xe_ttm_tt_populate()/xe_ttm_tt_unpopulate()use to decide whether to act, via a new xe_ttm_bo_is_imported()helper (hoisted up from its only prior use site).\nv2:- Fix the critical issue caught by Sashiko AI review: the pin-count  transition check introduced here was still bypassed by the fb-pin  path (__xe_pin_fb_vma()/__xe_unpin_fb_vma()), which could leave a  stale pinned_link entry and a permanent shrinker accounting leak  when the fb-unpin performed the true last unpin. Addressed in a  separate follow-up patch in this series rather than folded in here,  since it is a distinct bug with its own Fixes: tag.- Drop the unneeded local \"last_unpin\" variable in  xe_bo_unpin_external(), restoring the original inline  bo->ttm.pin_count == 1 check; it was a no-op rename not used by any  of the new accounting helpers, and was going to be deleted again by  the follow-up patch anyway.\nv3:- Exclude imported dma-bufs from the pin/unpin shrinker accounting,  fixing another underflow caught by Sashiko AI review.- Add a short comment on the backup-object pin site noting it's  already populated/accounted at pin time, addressing (as a  false-positive clarification, no code fix needed) a separate  Medium-severity accounting-leak concern also caught by Sashiko AI  ---truncated---\nhttps://www.cve.org/CVERecord?id=CVE-2026-99000https://git.kernel.org/stable/c/993c952e6832ad0aa4be82e11f0760b1f532090ahttps://git.kernel.org/stable/c/ab39bc55cf08208b8511b1c09926b1b646a8befchttps://git.kernel.org/stable/c/83d5acca1f4f6132038ea88c72c5844f62e42d44#kernel #Linux#CVE_2026_99000#bot", "url": "https://infosec.exchange/users/cve/statuses/117490503415916757"}, {"timestamp": "2026-10-23T15:31:34Z", "date_only": false, "value": "2026-10-23T15:31:34Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-M59J-MHQW-68MX", "record": "GHSA-M59J-MHQW-68MX", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-23T15:31:34Z", "date_only": false, "value": "2026-10-23T15:31:34Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-M59J-MHQW-68MX", "record": "GHSA-M59J-MHQW-68MX", "field": "modified", "linked_record": true}, {"timestamp": "2026-10-26T01:04:22Z", "date_only": false, "value": "2026-10-26T01:04:22.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99000", "record": "MSRC_CVE-2026-99000", "field": "document.tracking.revision_history.0.date", "linked_record": true}, {"timestamp": "2026-10-26T01:04:22Z", "date_only": false, "value": "2026-10-26T01:04:22.000Z", "kind": "milestone", "label": "Published", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99000", "record": "MSRC_CVE-2026-99000", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-26T01:04:22Z", "date_only": false, "value": "2026-10-26T01:04:22.000Z", "kind": "other", "label": "Updated", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99000", "record": "MSRC_CVE-2026-99000", "field": "document.tracking.current_release_date", "linked_record": true}, {"timestamp": "2026-10-26T07:00:42.602Z", "date_only": false, "value": "2026-10-26T07:00:42.602Z", "kind": "other", "label": "Document generated", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99000", "record": "MSRC_CVE-2026-99000", "field": "document.tracking.generator.date", "linked_record": true}, {"timestamp": "2026-10-28T06:07:54.756Z", "date_only": false, "value": "2026-10-28T06:07:54.756250Z", "kind": "milestone", "label": "Published", "source": "osv_bellsoft \u00b7 BELL-CVE-2026-99000", "record": "BELL-CVE-2026-99000", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-28T06:31:44.493Z", "date_only": false, "value": "2026-10-28T06:31:44.493713Z", "kind": "other", "label": "Updated", "source": "osv_bellsoft \u00b7 BELL-CVE-2026-99000", "record": "BELL-CVE-2026-99000", "field": "modified", "linked_record": true}, {"timestamp": "2026-10-30T06:30:10Z", "date_only": false, "value": "2026-10-30T06:30:10Z", "kind": "other", "label": "Updated", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-99000", "record": "UBUNTU-CVE-2026-99000", "field": "modified", "linked_record": true}], "metrics": {"as_of": "2026-11-06T03:11:35.995Z", "anchors": {"origin": {"timestamp": "2026-10-23T12:20:20.753Z", "date_only": false, "value": "2026-10-23T12:20:20.753Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-99000", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-10-23T12:20:20.753Z", "date_only": false, "value": "2026-10-23T12:20:20.753Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-99000", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 1176675.242448, "hours": 326.8542340133333, "days": 13.618926417222223, "min_seconds": 1176675.242448, "max_seconds": 1176675.242448, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-23T12:20:20.753Z", "date_only": false, "value": "2026-10-23T12:20:20.753Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-99000", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-06T03:11:35.995Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}