CVE-2026-89814 drm/amdgpu: clamp the isolation index for rings outside a partition

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: clamp the isolation index for rings outside a partition adev-isolation has one slot per partition, but a ring that is not assigned to one keeps AMDGPUXCPNOPARTITION, which is 0, so indexing the array with it is out of...

CVE-2026-89814

CVE-2026-89814 is an out-of-bounds array index vulnerability in the Linux kernel 's drm/amdgpu driver. The adev->isolation[] array has one slot per partition, but a ring not assigned to a partition retains the AMDGPU_XCP_NO_PARTITION value (~0), causing an out-of-bounds access. This is trigger...

CVE-2026-89813 drm/amdgpu: force complete the KIQ ring fences on reset

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: force complete the KIQ ring fences on reset Like the MES scheduler ring, the KIQ ring sets noscheduler = true and uses a polling fence, so it is skipped by the force-completion loop in amdgpudevicepreasicreset. Its hw...

CVE-2026-89813 drm/amdgpu: force complete the KIQ ring fences on reset

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: force complete the KIQ ring fences on reset Like the MES scheduler ring, the KIQ ring sets noscheduler = true and uses a polling fence, so it is skipped by the force-completion loop in amdgpudevicepreasicreset. Its hw...

EUVD-2026-80413

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: force complete the KIQ ring fences on reset Like the MES scheduler ring, the KIQ ring sets noscheduler = true and uses a polling fence, so it is skipped by the force-completion loop in amdgpudevicepreasicreset. Its hw...

CVE-2026-89813

This vulnerability affects the Linux kernel drm/amdgpu driver. The KIQ ring (like the MES scheduler ring) sets no_scheduler = true and uses a polling fence, causing it to be skipped by the force-completion loop in amdgpu_device_pre_asic_reset(). Because its hardware fence value resides in wb (GTT...

CVE-2026-89812

This vulnerability affects the drm/amdgpu driver in the Linux kernel . The MES (Micro Engine Scheduler) scheduler ring uses no_scheduler = true, causing it to be skipped by the force-completion loop in amdgpu_device_pre_asic_reset(). Its polling fence hw value resides in wb (GTT) memory that surv...

EUVD-2026-80412

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: force complete the MES ring fences on reset The MES scheduler ring has no drm scheduler noscheduler = true, so it is skipped by the force-completion loop in amdgpudevicepreasicreset. It uses a polling fence whose hw...

CVE-2026-89812 drm/amdgpu: force complete the MES ring fences on reset

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: force complete the MES ring fences on reset The MES scheduler ring has no drm scheduler noscheduler = true, so it is skipped by the force-completion loop in amdgpudevicepreasicreset. It uses a polling fence whose hw...

CVE-2026-89812 drm/amdgpu: force complete the MES ring fences on reset

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: force complete the MES ring fences on reset The MES scheduler ring has no drm scheduler noscheduler = true, so it is skipped by the force-completion loop in amdgpudevicepreasicreset. It uses a polling fence whose hw...

CVE-2026-89828: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix init ordering in amdgpuvrammgrinit drmmcgroupregisterregion is called before INITLISTHEAD and gpubuddyinit in amdgpuvrammgrinit. If it fails, the function returns early and bypasses those initializations. Since...

CVE-2026-89827: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: avoid force-completing uninitialized UVD rings uvdv70swinit does not initialize the UVD decode ring for an SR-IOV VF. However, amdgpuuvdresume unconditionally force-completes the decode ring when restoring its fence...

CVE-2026-89818: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vcn: fix integer overflow in decmsg buffer count check If the supplied msg2 numbuffers is 0x3FFFFFFF, the expression 6 + numbuffers 4 wraps to 2 and the bounds check passes, letting the parser loop far past the end of...

CVE-2026-89816: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: drm: Fix drmcrtccommit leak if signaled when PAGEFLIPEVENT is used Commit 1c6ceeee6ebb "drm/atomic: Fix memleak on ERESTARTSYS during non-blocking commits" fixed a very similar issue when the event was allocated by...

CVE-2026-89814: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: clamp the isolation index for rings outside a partition adev-isolation has one slot per partition, but a ring that is not assigned to one keeps AMDGPUXCPNOPARTITION, which is 0, so indexing the array with it is out of...

CVE-2026-89813: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: force complete the KIQ ring fences on reset Like the MES scheduler ring, the KIQ ring sets noscheduler = true and uses a polling fence, so it is skipped by the force-completion loop in amdgpudevicepreasicreset. Its hw...

CVE-2026-89812: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: force complete the MES ring fences on reset The MES scheduler ring has no drm scheduler noscheduler = true, so it is skipped by the force-completion loop in amdgpudevicepreasicreset. It uses a polling fence whose hw...

CVE-2026-89809: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix scope of mqdmgr dereference in pqmdebugfsmqds Reading /sys/kernel/debug/kfd/mqds while a process holds an active KFD queue triggers a NULL pointer dereference because the for loop that calls mqdmgr-debugfsshowmqd ...

PT-2026-93454

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the drm/amdgpu component where the KIQ ring is skipped by the force-completion loop in the amdgpu device pre asic reset function because it uses a polling fence and ha...

PT-2026-93459

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An integer overflow exists in the drm/amdgpu/vcn component during the dec msg buffer count check. When the num buffers variable is set to 0x3FFFFFFF, the calculation 6 + num buffers 4...