The Linux kernel's DRM xe driver contains a bug where nested external buffer pins incorrectly perform shrinker accounting on every pin and unpin call. Each nested pin subtracts page counts again and each unpin adds them back, leading to underflow of signed counters interpreted as unsigned, inflating shrinker page counts and causing excessive memory shrink operations under pressure. The result is a denial–of–service that can stall or thrash the system as the shrinker is invoked excessively.

Linux kernel, specifically the DRM xe component. No specific versions are listed, so all kernels containing the drm/xe driver prior to this patch are potentially affected. The issue arises wherever external dma‑buf objects are pinned multiple times through xe_bo_pin_external and unpinned via xe_bo_unpin_external. There is no alternative product name; the affected platform is generic Linux kernel DRM.

Based on the description, it is inferred that the attack vector is local, requiring the ability to trigger nested external pinning via drivers or applications that use the DRM xe component. The vulnerability does not provide remote code execution but can be exploited by anyone with the ability to trigger nested external pinning, such as local users with access to the device or drivers that perform dma‑buf imports. Because the underflow leads to inflated shrinker counters, an attacker could induce severe memory pressure, causing the kernel to aggressively reclaim memory and potentially halt application activity. The EPSS score is <1% and it is not listed in KEV, suggesting the exploit is rare or new, but the potential impact is significant. The CVSS score of 5.5 indicates moderate severity, reflecting a moderate risk to system availability and stability without privilege escalation.