UBUNTU-CVE-2026-80540

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix UVD decode image min size calculation This needs to use pitch instead of width. Also reject pitch over 4096 to avoid overflow. cherry picked from commit b41c8cb12e202b220353332ab87dc01a11f69304...

UBUNTU-CVE-2026-80542

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix NULL pointer dereference in amdgpudmcrtcsetvblank amdgpudmcrtcsetvblank dereferences acrtcstate-stream when vblank is enabled/queried from DRMIOCTLMODECRTCGETSEQUENCE before a stream is attached to it. BUG:...

UBUNTU-CVE-2026-80541

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: validate GEMCREATE domain combinations AMDGPUGEMCREATE checked domain bits against AMDGPUGEMDOMAINMASK, but did not validate domain combinations. Userspace could combine CPU|GTT|VRAM with DOORBELL, GDS, GWS, or OA,...

UBUNTU-CVE-2026-80539

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: disallow multiple FENCE chunks in one submit amdgpucspass1 dispatches on chunkid once per chunk without rejecting repeated ids. p-ufbo is a single-slot field, so a submission carrying two AMDGPUCHUNKIDFENCE chunks run...

CVE-2026-80539

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: disallow multiple FENCE chunks in one submit amdgpucspass1 dispatches on chunkid once per chunk without rejecting repeated ids. p-ufbo is a single-slot field, so a submission carrying two AMDGPUCHUNKIDFENCE chunks run...

CVE-2026-80576

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: reject oversized IBs with per-ring packet limits On GFX rings, amdgpucsp2ib passed user-supplied ibbytes through to ib-lengthdw without a limit, while ringemitib encodes length into packet fields. Oversized values can...

CVE-2026-80541

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: validate GEMCREATE domain combinations AMDGPUGEMCREATE checked domain bits against AMDGPUGEMDOMAINMASK, but did not validate domain combinations. Userspace could combine CPU|GTT|VRAM with DOORBELL, GDS, GWS, or OA,...

CVE-2026-80540

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix UVD decode image min size calculation This needs to use pitch instead of width. Also reject pitch over 4096 to avoid overflow. cherry picked from commit b41c8cb12e202b220353332ab87dc01a11f69304...

CVE-2026-80542

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix NULL pointer dereference in amdgpudmcrtcsetvblank amdgpudmcrtcsetvblank dereferences acrtcstate-stream when vblank is enabled/queried from DRMIOCTLMODECRTCGETSEQUENCE before a stream is attached to it. BUG:...

CVE-2026-80576

CVE-2026-80576 affects the Linux kernel's drm/amdgpu driver. In amdgpu_cs_p2_ib(), a user-supplied ib_bytes value was passed to ib->length_dw without a limit. Since ring_emit_ib() encodes this length into packet fields, oversized values can corrupt adjacent control bits , destabilizing command...

CVE-2026-80576 drm/amdgpu: reject oversized IBs with per-ring packet limits

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: reject oversized IBs with per-ring packet limits On GFX rings, amdgpucsp2ib passed user-supplied ibbytes through to ib-lengthdw without a limit, while ringemitib encodes length into packet fields. Oversized values can...

CVE-2026-80576 drm/amdgpu: reject oversized IBs with per-ring packet limits

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: reject oversized IBs with per-ring packet limits On GFX rings, amdgpucsp2ib passed user-supplied ibbytes through to ib-lengthdw without a limit, while ringemitib encodes length into packet fields. Oversized values can...

CVE-2026-80576 drm/amdgpu: reject oversized IBs with per-ring packet limits

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: reject oversized IBs with per-ring packet limits On GFX rings, amdgpucsp2ib passed user-supplied ibbytes through to ib-lengthdw without a limit, while ringemitib encodes length into packet fields. Oversized values can...

CVE-2026-80542

CVE-2026-80542 is a NULL pointer dereference in the Linux kernel's AMD GPU display driver (drm/amd/amdgpu). The vulnerable function amdgpu_dm_crtc_set_vblank() dereferences acrtc_state->stream before a stream is attached to the CRTC, causing a kernel crash at address 0x8 when vblank is enabled...

EUVD-2026-66457

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix NULL pointer dereference in amdgpudmcrtcsetvblank amdgpudmcrtcsetvblank dereferences acrtcstate-stream when vblank is enabled/queried from DRMIOCTLMODECRTCGETSEQUENCE before a stream is attached to it. BUG:...

CVE-2026-80542 drm/amd/display: Fix NULL pointer dereference in amdgpu_dm_crtc_set_vblank()

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix NULL pointer dereference in amdgpudmcrtcsetvblank amdgpudmcrtcsetvblank dereferences acrtcstate-stream when vblank is enabled/queried from DRMIOCTLMODECRTCGETSEQUENCE before a stream is attached to it. BUG:...

CVE-2026-80541

A vulnerability in the Linux kernel's drm/amdgpu driver allows a local, low-privileged user to trigger a kernel BUG_ON() crash by crafting a GEM_CREATE ioctl with an invalid combination of domain flags (e.g., CPU|GTT|VRAM combined with DOORBELL, GDS, GWS, or OA). The root cause is that while indi...

CVE-2026-80541 drm/amdgpu: validate GEM_CREATE domain combinations

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: validate GEMCREATE domain combinations AMDGPUGEMCREATE checked domain bits against AMDGPUGEMDOMAINMASK, but did not validate domain combinations. Userspace could combine CPU|GTT|VRAM with DOORBELL, GDS, GWS, or OA,...

CVE-2026-80541 drm/amdgpu: validate GEM_CREATE domain combinations

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: validate GEMCREATE domain combinations AMDGPUGEMCREATE checked domain bits against AMDGPUGEMDOMAINMASK, but did not validate domain combinations. Userspace could combine CPU|GTT|VRAM with DOORBELL, GDS, GWS, or OA,...

CVE-2026-80541 drm/amdgpu: validate GEM_CREATE domain combinations

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: validate GEMCREATE domain combinations AMDGPUGEMCREATE checked domain bits against AMDGPUGEMDOMAINMASK, but did not validate domain combinations. Userspace could combine CPU|GTT|VRAM with DOORBELL, GDS, GWS, or OA,...