CVE-2026-99004

The Linux kernel contains a vulnerability in the drm/imagination driver related to how page table preallocation is sized by device address. The root cause involves an incorrect calculation where preallocation was sized from device_addr + sgt_offset with an exclusive end, causing the allocation of...

CVE-2026-99003 drm/panthor: validate userspace queue count against initialized firmware slot count

In the Linux kernel, the following vulnerability has been resolved: drm/panthor: validate userspace queue count against initialized firmware slot count In panthordrv.c:panthorioctlgroupcreate, the queue count is validated against the hardcoded maximum: if !args-queues.count || args-queues.count...

CVE-2026-99003 drm/panthor: validate userspace queue count against initialized firmware slot count

In the Linux kernel, the following vulnerability has been resolved: drm/panthor: validate userspace queue count against initialized firmware slot count In panthordrv.c:panthorioctlgroupcreate, the queue count is validated against the hardcoded maximum: if !args-queues.count || args-queues.count...

CVE-2026-99003

The Linux kernel contains a vulnerability in the drm/panthor driver within the panthor_drv.c:panthor_ioctl_group_create() function. The driver incorrectly validates the userspace queue count against a hardcoded maximum (MAX_CS_PER_CSG) instead of the actual number of slots reported by the firmwar...

EUVD-2026-108797

In the Linux kernel, the following vulnerability has been resolved: drm/panthor: validate userspace queue count against initialized firmware slot count In panthordrv.c:panthorioctlgroupcreate, the queue count is validated against the hardcoded maximum: if !args-queues.count || args-queues.count...

CVE-2026-99002 drm/vmwgfx: validate pitch coming from userspace

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: validate pitch coming from userspace Validate the pitch, alongside the box dimensions before trying to copy data from the underlying surface. Fixes possible out of bounds reads with cursor snooping...

CVE-2026-99002

The Linux kernel contains a vulnerability in the drm/vmwgfx component where the system fails to properly validate the pitch provided from userspace. This lack of validation, alongside box dimensions, when copying data from the underlying surface, can lead to out-of-bounds reads during cursor snoo...

CVE-2026-99002 drm/vmwgfx: validate pitch coming from userspace

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: validate pitch coming from userspace Validate the pitch, alongside the box dimensions before trying to copy data from the underlying surface. Fixes possible out of bounds reads with cursor snooping...

EUVD-2026-108796

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: validate pitch coming from userspace Validate the pitch, alongside the box dimensions before trying to copy data from the underlying surface. Fixes possible out of bounds reads with cursor snooping...

CVE-2026-99001 drm/xe/i2c: cancel the client work on remove

In the Linux kernel, the following vulnerability has been resolved: drm/xe/i2c: cancel the client work on remove xei2cnotifier stores the DesignWare adapter in i2c-adapter and schedules i2c-work when the adapter is registered under the xe I2C platform device, and xei2cclientwork then instantiates...

CVE-2026-99001 drm/xe/i2c: cancel the client work on remove

In the Linux kernel, the following vulnerability has been resolved: drm/xe/i2c: cancel the client work on remove xei2cnotifier stores the DesignWare adapter in i2c-adapter and schedules i2c-work when the adapter is registered under the xe I2C platform device, and xei2cclientwork then instantiates...

EUVD-2026-108795

In the Linux kernel, the following vulnerability has been resolved: drm/xe/i2c: cancel the client work on remove xei2cnotifier stores the DesignWare adapter in i2c-adapter and schedules i2c-work when the adapter is registered under the xe I2C platform device, and xei2cclientwork then instantiates...

CVE-2026-99001

The Linux kernel contains a vulnerability in the drm/xe/i2c component where xe_i2c_remove() fails to drain i2c->work during teardown. This allows a queued or running work item to dereference i2c->adapter after it has been released by platform_device_unregister(). Additionally, because the w...

EUVD-2026-108794

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix shrinker accounting double-subtraction on nested external pins xebopinexternal and xebounpinexternal support nested pins, since the underlying ttmbopin/ttmbounpin maintain a pincount refcount rather than a boolean...

CVE-2026-99000 drm/xe: Fix shrinker accounting double-subtraction on nested external pins

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix shrinker accounting double-subtraction on nested external pins xebopinexternal and xebounpinexternal support nested pins, since the underlying ttmbopin/ttmbounpin maintain a pincount refcount rather than a boolean...

CVE-2026-99000

The Linux kernel contains a vulnerability in the drm/xe driver where xe_bo_pin_external() and xe_bo_unpin_external() perform unconditional shrinker accounting calls on nested pins. Because external BOs (such as dma-buf ) can be pinned multiple times, these nested calls cause a double-subtraction ...

CVE-2026-99000 drm/xe: Fix shrinker accounting double-subtraction on nested external pins

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix shrinker accounting double-subtraction on nested external pins xebopinexternal and xebounpinexternal support nested pins, since the underlying ttmbopin/ttmbounpin maintain a pincount refcount rather than a boolean...

CVE-2026-98999 drm/xe: Fix stale pinned_link entry when fb-pin performs the final unpin

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix stale pinnedlink entry when fb-pin performs the final unpin xebopinexternal and xebounpinexternal maintain the bo's pinnedlink list membership in xe-pinned.late.external, based on whether the current call is the...

EUVD-2026-108793

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix stale pinnedlink entry when fb-pin performs the final unpin xebopinexternal and xebounpinexternal maintain the bo's pinnedlink list membership in xe-pinned.late.external, based on whether the current call is the...

CVE-2026-98999

The Linux kernel contains a vulnerability in the drm/xe driver where a buffer object (bo ) can remain linked in the xe->pinned.late.external list indefinitely. This occurs when a bo is pinned both externally (e.g., dma-buf export) and as a framebuffer (fb ); if the external unpin occurs first,...