CVE-2026-98521

The Linux kernel 's drm/i915 driver contains a vulnerability where the i915_gem_busy_ioctl function fails to hold a proper reference while iterating over fences in a GEM object , relying only on the RCU read side lock. This allows a GEM object to be destroyed concurrently, causing dma_resv_for_ea...

CVE-2026-98519 drm/amdgpu: Fix runtime PM leak in amdgpu_debugfs_test_ib_show()

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix runtime PM leak in amdgpudebugfstestibshow amdgpudebugfstestibshow resumes the device with pmruntimegetsync before taking the reset domain semaphore with downwritekillable. If the write lock acquisition is...

CVE-2026-98519

The Linux kernel 's amdgpu driver contains a runtime PM leak in the amdgpu_debugfs_test_ib_show() function. The issue occurs because the function resumes the device using pm_runtime_get_sync() before acquiring the reset domain semaphore with down_write_killable() . If the write lock acquisition i...

EUVD-2026-103759

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix runtime PM leak in amdgpudebugfstestibshow amdgpudebugfstestibshow resumes the device with pmruntimegetsync before taking the reset domain semaphore with downwritekillable. If the write lock acquisition is...

CVE-2026-98519 drm/amdgpu: Fix runtime PM leak in amdgpu_debugfs_test_ib_show()

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix runtime PM leak in amdgpudebugfstestibshow amdgpudebugfstestibshow resumes the device with pmruntimegetsync before taking the reset domain semaphore with downwritekillable. If the write lock acquisition is...

CVE-2026-98518 drm/nouveau/dmem: pin VRAM for the whole registered range

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/dmem: pin VRAM for the whole registered range Commit c32287471077 "gpu/drm/nouveau: enable THP support for GPU memory migration" grew the device-private region that nouveaudmemchunkalloc registers from DMEMCHUNKSIZE t...

CVE-2026-98518 drm/nouveau/dmem: pin VRAM for the whole registered range

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/dmem: pin VRAM for the whole registered range Commit c32287471077 "gpu/drm/nouveau: enable THP support for GPU memory migration" grew the device-private region that nouveaudmemchunkalloc registers from DMEMCHUNKSIZE t...

CVE-2026-98518

The Linux kernel contains a vulnerability in the drm/nouveau/dmem component related to how it handles VRAM registration. Specifically, commit c32287471077 increased the device-private region registered by nouveau_dmem_chunk_alloc() from DMEM_CHUNK_SIZE to DMEM_CHUNK_SIZE * NR_CHUNKS , but failed ...

EUVD-2026-103758

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/dmem: pin VRAM for the whole registered range Commit c32287471077 "gpu/drm/nouveau: enable THP support for GPU memory migration" grew the device-private region that nouveaudmemchunkalloc registers from DMEMCHUNKSIZE t...

CVE-2026-98517 drm/nouveau/uvmm: fix UAF in nouveau_uvmm_sm when BO is in TTM_PL_SYSTEM

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/uvmm: fix UAF in nouveauuvmmsm when BO is in TTMPLSYSTEM nouveauuvmmsm calls opmap, which passes bo-resource through nouveaumem to nouveauuvmamap. nouveauuvmmvmmmap then reads mem-mem.type. But this is only valid when...

EUVD-2026-103757

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/uvmm: fix UAF in nouveauuvmmsm when BO is in TTMPLSYSTEM nouveauuvmmsm calls opmap, which passes bo-resource through nouveaumem to nouveauuvmamap. nouveauuvmmvmmmap then reads mem-mem.type. But this is only valid when...

CVE-2026-98517 drm/nouveau/uvmm: fix UAF in nouveau_uvmm_sm when BO is in TTM_PL_SYSTEM

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/uvmm: fix UAF in nouveauuvmmsm when BO is in TTMPLSYSTEM nouveauuvmmsm calls opmap, which passes bo-resource through nouveaumem to nouveauuvmamap. nouveauuvmmvmmmap then reads mem-mem.type. But this is only valid when...

CVE-2026-98517

A use-after-free (UAF) vulnerability exists in the Linux kernel 's nouveau driver, specifically within the uvmm component. The issue occurs in nouveau_uvmm_sm() when it calls op_map(), which passes bo->resource to nouveau_uvma_map(). If the Buffer Object (BO) is left in the TTM_PL_SYSTEM state...

CVE-2026-98516

The Linux kernel contains a vulnerability in the drm/nouveau component where a bridge reference leak occurs in the nv1a_ram_new() function. The issue stems from the pci_get_domain_bus_and_slot() function taking a reference to the PCI device that is not released after the memory size is read from ...

CVE-2026-98516 drm/nouveau: Fix bridge reference leak in nv1a_ram_new()

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: Fix bridge reference leak in nv1aramnew pcigetdomainbusandslot takes a reference to the PCI device, which is never released once the memory size has been read from its config space. Drop the reference before returnin...

CVE-2026-98516 drm/nouveau: Fix bridge reference leak in nv1a_ram_new()

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: Fix bridge reference leak in nv1aramnew pcigetdomainbusandslot takes a reference to the PCI device, which is never released once the memory size has been read from its config space. Drop the reference before returnin...

EUVD-2026-103756

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: Fix bridge reference leak in nv1aramnew pcigetdomainbusandslot takes a reference to the PCI device, which is never released once the memory size has been read from its config space. Drop the reference before returnin...

CVE-2026-98515 drm/nouveau: fix double-free in nvif_vmm_dtor

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: fix double-free in nvifvmmdtor On failure, nouveaucliinit calls nouveauclifini to tear the client down. Then, nouveaudrmopen also enters into its cleanup path and calls nouveauclifini AGAIN. nouveauclifini calls...

EUVD-2026-103755

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: fix double-free in nvifvmmdtor On failure, nouveaucliinit calls nouveauclifini to tear the client down. Then, nouveaudrmopen also enters into its cleanup path and calls nouveauclifini AGAIN. nouveauclifini calls...

CVE-2026-98515 drm/nouveau: fix double-free in nvif_vmm_dtor

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: fix double-free in nvifvmmdtor On failure, nouveaucliinit calls nouveauclifini to tear the client down. Then, nouveaudrmopen also enters into its cleanup path and calls nouveauclifini AGAIN. nouveauclifini calls...