UBUNTU-CVE-2026-68256

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: detectlinkandlocalsink: DP alt mode timeout path leaks prevsink reference prevsink is unconditionally retained via dcsinkretain at function entry, but the DP alt mode timeout path inside SIGNALTYPEDISPLAYPORT...

UBUNTU-CVE-2026-68329

In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Wait for completion instead of returning early in iommucompletionwait needsync is a per-IOMMU flag shared by all domains and devices behind that IOMMU. It is set whenever a command is queued with sync == true and clear...

UBUNTU-CVE-2026-68236

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: set newstream to NULL after release In dmupdatecrtcstate, the skipmodeset path releases newstream via dcstreamrelease but does not set the pointer to NULL. If a later error e.g., color management failure triggers...

UBUNTU-CVE-2026-68112

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/gfx9.4.3: replace BUGON with WARNON There's no need to crash the kernel for these cases. cherry picked from commit 5676593d08998d7a6d9e2d51d6b54b3820e3755c...

UBUNTU-CVE-2026-68115

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/gfx10: replace BUGON with WARNON There's no need to crash the kernel for these cases. cherry picked from commit ac6f00beb658239bced4aaed9efbb04a35348d48...

CVE-2026-68108

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vce: fix integer overflow in image size Fix a security vulnerability where malicious VCE command streams with oversized dimensions e.g. 65536×65536 cause 32-bit integer overflow, wrapping the calculated buffer size to ...

CVE-2026-68364

The CVE-2026-68364 entry concerns the Linux kernel DRM/AMD display subsystem. It describes a deadlock in the ISM path (dc_lock) during suspend caused by amdgpu_dm_ism_disable() waiting for ISM work that itself acquires dc_lock, creating an ABBA deadlock when a worker is in flight at suspend. The ...

CVE-2026-68347 iommu/amd: Fix IRQ unsafe locking in gdom allocation

In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Fix IRQ unsafe locking in gdom allocation Lockdep complains: 259.410489 ===================================================== 259.417287 WARNING: HARDIRQ-safe - HARDIRQ-unsafe lock order detected 259.424667...

EUVD-2026-55448

In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Fix IRQ unsafe locking in gdom allocation Lockdep complains: 259.410489 ===================================================== 259.417287 WARNING: HARDIRQ-safe - HARDIRQ-unsafe lock order detected 259.424667...

CVE-2026-68347

CVE-2026-68347 pertains to the Linux kernel’s amd iommu code. The vulnerability arises from IRQ-unsafe locking in gdom allocation and in the IOMMU destroy/free path, leading to lock-order conflicts when HARDIRQ-safe locks become HARDIRQ-unsafe. The documented fix switches the allocation path in g...

CVE-2026-68329 iommu/amd: Wait for completion instead of returning early in iommu_completion_wait()

In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Wait for completion instead of returning early in iommucompletionwait needsync is a per-IOMMU flag shared by all domains and devices behind that IOMMU. It is set whenever a command is queued with sync == true and clear...

CVE-2026-68329 iommu/amd: Wait for completion instead of returning early in iommu_completion_wait()

In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Wait for completion instead of returning early in iommucompletionwait needsync is a per-IOMMU flag shared by all domains and devices behind that IOMMU. It is set whenever a command is queued with sync == true and clear...

CVE-2026-68329

CVE-2026-68329 affects the Linux kernel’s iommu/amd path. A race in iommu_completion_wait() can cause it to return before all previously queued commands complete, enabling a use-after-free window where stale page-table translations may be used. The issue stems from need_sync being read locklessly...

CVE-2026-68325

The Linux kernel AMD IOMMU path (ivrs_acpihid parser) is affected by CVE-2026-68325. The parser appends entries to a fixed four-element early_acpihid_map and, unlike the IOAPIC/HPET parsers, does not reject a fifth entry before increasing the map size. The patch adds a capacity check at the commo...

CVE-2026-68325 iommu/amd: Bound the early ACPI HID map

In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Bound the early ACPI HID map The ivrsacpihid command-line parser appends entries to a fixed four-element earlyacpihidmap array. Unlike the sibling IOAPIC and HPET parsers, it does not reject a fifth entry before...

CVE-2026-68325 iommu/amd: Bound the early ACPI HID map

In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Bound the early ACPI HID map The ivrsacpihid command-line parser appends entries to a fixed four-element earlyacpihidmap array. Unlike the sibling IOAPIC and HPET parsers, it does not reject a fifth entry before...

CVE-2026-68275

The CVE-2026-68275 entry concerns the Linux kernel DRM/AMDGPU driver. In the AMDGPU GEM GET_MAPPING_INFO path, amdgpu_gem_op_ioctl() looks up the BO in the caller’s VM via amdgpu_vm_bo_find() but does not verify the returned pointer before using it. If no bo_va exists for the BO in that VM (the n...

CVE-2026-68272 drm/amdgpu: validate CP_GFX_SHADOW chunk size in CS pass1

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: validate CPGFXSHADOW chunk size in CS pass1 Add a minimum-length check for the AMDGPUCHUNKIDCPGFXSHADOW chunk in amdgpucspass1, matching the gate already present for the IB, FENCE and BOHANDLES chunk types. The...

CVE-2026-68256 drm/amd/display: detect_link_and_local_sink: DP alt mode timeout path leaks prev_sink reference

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: detectlinkandlocalsink: DP alt mode timeout path leaks prevsink reference prevsink is unconditionally retained via dcsinkretain at function entry, but the DP alt mode timeout path inside SIGNALTYPEDISPLAYPORT...

CVE-2026-68256

Summary: CVE-2026-68256 affects the Linux kernel DRM/AMD Display stack, specifically the function detect_link_and_local_sink. The issue: on the DP alt mode timeout path inside SIGNAL_TYPE_DISPLAY_PORT, prev_sink is not released, whereas all other paths correctly call dc_sink_release(prev_sink). T...