CVE-2026-93233

In the Linux kernel, the following vulnerability has been resolved:

drm/nouveau/dmem: fix callocated underflow on large folio split

nouveau_dmem_folio_free() drops chunk->callocated once per freed folio,

while a large (compound) device-private folio is only counted once when

it is allocated. When such a folio is split, the mm core invokes

->folio_split() (nouveau_dmem_folio_split()) once for each new

sub-folio, but the hook only fixes up the sub-folio metadata and leaves

chunk->callocated unchanged.

Each resulting sub-folio is later freed separately, so after a split

the single allocation (+1) is met by N frees (-N), leaving

chunk->callocated short by N-1. On the first split/free cycle it

underflows: WARN_ON(!chunk->callocated) fires, the unsigned counter

wraps and never returns to zero, so the chunk can no longer be

reclaimed (nouveau_dmem_fini() also warns on the leaked count).

Account for the new sub-folio in the split hook, under the same lock as

nouveau_dmem_folio_free(), so the count stays balanced.