This vulnerability stems from an error in the Linux kernel’s DRM/xe subsystem where pinned buffer objects (bos) have their pages incorrectly transferred between shrinkable and purgeable categories when their purgeable state changes. The logic that updates the count unconditionally underflows the shrinker's purgeable counter and permanently inflates the shrinkable counter once the bos is unpinned. The primary impact is a corruption of kernel memory accounting, which could cause the kernel to misreport free memory, potentially leading to system instability or denial of service. The weakness, an integer underflow, is represented by CWE-193.

All Linux kernel images that include the DRM/xe driver are affected, specifically those that have not yet incorporated the commit that resolved the issue (afe6bc012034123fd838328668e609bf57e46bd3). In practice, this means any actively maintained kernel version prior to the hotfix commit is vulnerable; newer releases that integrate the patch are not. The vulnerability does not target any specific vendor distribution but applies globally to kernels compiled with the DRM/xe subsystems.

No CVSS score appears in the available data, indicating limited publicly disclosed exploitation data. The vulnerability is not present in the CISA KEV catalog. While the potential for a local or privileged attacker to trigger the misuse of shrinker counts exists—especially if the attacker forces a VMA of a pinned bos to receive a MADV_DONTNEED—they require substantial knowledge of the kernel’s internal DRM/xe behavior and the system on which the vulnerable kernel runs. In the absence of a public exploit, the risk is considered moderate due to the low probability of successful exploitation and the lack of known active attacks. However, the impact on kernel memory accounting warrants prompt remediation.