CVE-2026-98999— Intel Xe DRM 驱动程序链接表项失效漏洞
一分钟漏洞结论
影响对象
Linux Linux
利用判断
尚无明确在野利用证据，仍需结合暴露面评估
建议动作
优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。
在 Linux 内核中，以下漏洞已得到修复： drm/xe：修复 fb-pin 执行最终取消固定（unpin）时遗留的过期 pinned_link 条目 和 函数根据当前调用是否为最外层的固定（pin）或最终的取消固定操作，维护缓冲对象（BO）在 列表中的 成员资格。然而，同一个外部 BO 的 也可以通过 和 直接增加或减少。这两个函数将 BO 作为显示扫描缓冲区（scanout buffer）进行固定，但完全绕过了 和 ，因此它们对 既无认知也无所有权。 如果一个 BO 同时被外部固定（例如通过 dma-buf
影响版本矩阵 8
| 厂商 | 产品 | 版本范围 | 状态 |
|---|---|---|---|
| Linux | Linux | 44e694958b95395bd1c41508c88c8ca141bf9bd7< 3a11adcfd9a2de74d405bd3e8c4d7a1b328e4684 |
affected |
44e694958b95395bd1c41508c88c8ca141bf9bd7< b3eaff982839e5c22912d604cd8e7748cece8d63 |
affected | ||
44e694958b95395bd1c41508c88c8ca141bf9bd7< cf238c067eaae1cbfb00738e29219b9568d2313e |
affected | ||
6.8 |
affected | ||
< 6.8 |
unaffected | ||
6.18.57≤ 6.18.* |
unaffected | ||
7.2.11≤ 7.2.* |
unaffected | ||
7.3≤ * |
unaffected |
获取后续新漏洞提醒
登录后订阅
一、 漏洞 CVE-2026-98999 基础信息
漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
drm/xe: Fix stale pinned_link entry when fb-pin performs the final unpin
来源: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved:
drm/xe: Fix stale pinned_link entry when fb-pin performs the final unpin
xe_bo_pin_external() and xe_bo_unpin_external() maintain the bo's
pinned_link list membership in xe->pinned.late.external, based on
whether the current call is the outermost pin or the final unpin.
However, the same external bo's pin_count can also be raised and
lowered directly by __xe_pin_fb_vma()/__xe_unpin_fb_vma(), which pin
the bo as a display scanout buffer without going through
xe_bo_pin_external()/xe_bo_unpin_external() at all, and have no
notion of, or ownership over, pinned_link.
If a bo is pinned both externally (e.g. dma-buf export) and as an fb,
and the external unpin happens first, xe_bo_unpin_external() correctly
observes pin_count > 1 and leaves the bo on pinned_link. When the fb
unpin later performs the true last unpin (pin_count 1 -> 0), it never
touches pinned_link, leaving the bo linked on xe->pinned.late.external
indefinitely. Once the bo is subsequently freed, this stale list entry
points into freed memory, corrupting the list and risking a
use-after-free the next time the list is walked or spliced.
The backup object pin/unpin sites in xe_bo_notifier_prepare_pinned()/
xe_bo_notifier_unprepare_pinned() have the same bypass characteristic,
though they never add their bo to a pinned list, so are not affected
by this particular list-corruption issue.
Move the pinned_link removal into xe_bo_account_unpin(), which already
runs on every unpin path (kernel, external, framebuffer, backup
object) right before the true 1 -> 0 pin_count transition. Since
list_del_init() only operates on the node itself, this removal is
list-agnostic and safe to perform regardless of which list (external
or kernel_bo_present) the bo happens to be linked on, or which code
path is performing the final unpin. Drop the now-redundant explicit
list_del_init() calls in xe_bo_unpin_external() and xe_bo_unpin().
v2:
- New patch
v3:
- Rebased on changes to previous patch.
(cherry picked from commit ca58d36a1f93af586ee93b340c9f9fd81312cc01)
来源: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
来源: CVE Program / CVE List V5
Vulnerability Type
N/A
来源: CVE Program / CVE List V5
受影响产品
二、漏洞 CVE-2026-98999 的公开POC
| # | POC 描述 | 源链接 | 神龙链接 |
|---|
AI 生成 POC
高级
未找到公开 POC。
登录以生成 AI POC三、漏洞 CVE-2026-98999 的情报信息
请登录查看更多情报信息。
CVE-2026-98999 补丁与修复 (3)
同批安全公告 · Linux · 2026-10-23 · 共 218 条
| CVE-2026-98959 | 9.8 CRITICAL | btrfs 扩展属性替换处理远程代码执行漏洞 |
| CVE-2026-99079 | 9.8 CRITICAL | Mellanox mlx5e 驱动 XSK 缓冲区释放漏洞 |
| CVE-2026-99078 | 9.8 CRITICAL | Mellanox mlx5e MPWQE重试时XSK缓冲区释放漏洞 |
| CVE-2026-98870 | 8.8 HIGH | ksmbd 会话清理时存在通道移除逻辑漏洞 |
| CVE-2026-98980 | 8.8 HIGH | namei 遍历中过度挂载条目信息泄露漏洞 |
| CVE-2026-99083 | 8.8 HIGH | ksmbd 的 krb5_authenticate() 函数堆越界写漏洞 |
| CVE-2026-99082 | 8.8 HIGH | KVM x86 内存管理漏洞 |
| CVE-2026-98981 | 8.8 HIGH | Linux 内核命名空间 dentry 解挂载前未哈希漏洞 |
| CVE-2026-98988 | 8.8 HIGH | Linux 5.13 命名空间越界漏洞 |
| CVE-2026-98978 | 8.4 HIGH | Linux 命名空间 锁定挂载永不失效漏洞 |
| CVE-2026-99042 | 8.4 HIGH | io_uring 24 字节 sockaddr_in6 过滤字段填充漏洞 |
| CVE-2026-99064 | 8.1 HIGH | CIPSO 缓存选项偏移调整漏洞 |
| CVE-2026-98968 | 8.1 HIGH | AMT 中继通用查询远程代码执行漏洞 |
| CVE-2026-99054 | 7.8 HIGH | Linux TIPC 拓扑服务队列资源泄漏漏洞 |
| CVE-2026-98975 | 7.8 HIGH | XFS 文件系统 reflink 标志交换逻辑漏洞 |
| CVE-2026-99053 | 7.8 HIGH | Linux TIPC 节点引用漏洞 |
| CVE-2026-98995 | 7.8 HIGH | Linux 内核 mnt_change_mountpoint 越界漏洞 |
| CVE-2026-98944 | 7.8 HIGH | Steam HID 注册重构漏洞 |
| CVE-2026-99051 | 7.8 HIGH | fsverity 信息结构释放延迟漏洞 |
| CVE-2026-98974 | 7.8 HIGH | XFS 文件系统范围交换到文件末尾大小漏洞 |
显示前 20 条，共 218 条。 查看全部 → →