CVE-2026-68276 drm/amdgpu/gfx: fix cleaner shader IB buffer overflow

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/gfx: fix cleaner shader IB buffer overflow The cleaner shader sysfs path allocates a 16-dword 64 byte IB but incorrectly fills alignmask + 1 dwords. On GFX rings alignmask is 0xff, so the loop wrote 256 dwords into a...

EUVD-2026-55377

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/gfx: fix cleaner shader IB buffer overflow The cleaner shader sysfs path allocates a 16-dword 64 byte IB but incorrectly fills alignmask + 1 dwords. On GFX rings alignmask is 0xff, so the loop wrote 256 dwords into a...

CVE-2026-68276 drm/amdgpu/gfx: fix cleaner shader IB buffer overflow

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/gfx: fix cleaner shader IB buffer overflow The cleaner shader sysfs path allocates a 16-dword 64 byte IB but incorrectly fills alignmask + 1 dwords. On GFX rings alignmask is 0xff, so the loop wrote 256 dwords into a...

EUVD-2026-55376

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: check amdgpuvmbofind result in GETMAPPINGINFO The AMDGPUGEMOPGETMAPPINGINFO path of amdgpugemopioctl looks up the bova for the buffer object in the caller's VM via amdgpuvmbofind, but uses the returned pointer without...

CVE-2026-68275 drm/amdgpu: check amdgpu_vm_bo_find() result in GET_MAPPING_INFO

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: check amdgpuvmbofind result in GETMAPPINGINFO The AMDGPUGEMOPGETMAPPINGINFO path of amdgpugemopioctl looks up the bova for the buffer object in the caller's VM via amdgpuvmbofind, but uses the returned pointer without...

CVE-2026-68275 drm/amdgpu: check amdgpu_vm_bo_find() result in GET_MAPPING_INFO

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: check amdgpuvmbofind result in GETMAPPINGINFO The AMDGPUGEMOPGETMAPPINGINFO path of amdgpugemopioctl looks up the bova for the buffer object in the caller's VM via amdgpuvmbofind, but uses the returned pointer without...

CVE-2026-68273 drm/amdgpu: Fix context pstate override handling

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix context pstate override handling There are several problems in the context pstate handling code. The most serious ones are potential use-after-free and NULL pointer dereferences at context initialization time. Bot...

CVE-2026-68273 drm/amdgpu: Fix context pstate override handling

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix context pstate override handling There are several problems in the context pstate handling code. The most serious ones are potential use-after-free and NULL pointer dereferences at context initialization time. Bot...

CVE-2026-68273

The CVE-2026-68273 entry concerns the Linux kernel amdgpu driver: flawed context pstate override handling can trigger use-after-free and NULL pointer dereferences during context initialization and finalization. The issue stems from incorrect locking around the context state (amdgpu_ctx_init not h...

EUVD-2026-55373

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: validate CPGFXSHADOW chunk size in CS pass1 Add a minimum-length check for the AMDGPUCHUNKIDCPGFXSHADOW chunk in amdgpucspass1, matching the gate already present for the IB, FENCE and BOHANDLES chunk types. The...

CVE-2026-68272

The CVE-2026-68272 affects the Linux kernel DRM/AMDGPU stack. It introduces a minimum-length validation for the AMDGPU_CHUNK_ID_CP_GFX_SHADOW chunk in amdgpu_cs_pass1(), so undersized chunks (length_dw == 0) are now rejected with -EINVAL before pass2 dereferences data. Previously, a zero-size poi...

CVE-2026-68272 drm/amdgpu: validate CP_GFX_SHADOW chunk size in CS pass1

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: validate CPGFXSHADOW chunk size in CS pass1 Add a minimum-length check for the AMDGPUCHUNKIDCPGFXSHADOW chunk in amdgpucspass1, matching the gate already present for the IB, FENCE and BOHANDLES chunk types. The...

CVE-2026-68252 drm/amdgpu/sdma7.0: replace BUG_ON() with WARN_ON()

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/sdma7.0: replace BUGON with WARNON There's no need to crash the kernel for these cases. cherry picked from commit 9723a8bed3aa251a26bee4583bac9d8fb064dd44...

CVE-2026-68252 drm/amdgpu/sdma7.0: replace BUG_ON() with WARN_ON()

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/sdma7.0: replace BUGON with WARNON There's no need to crash the kernel for these cases. cherry picked from commit 9723a8bed3aa251a26bee4583bac9d8fb064dd44...

CVE-2026-68252

The CVE affects the Linux kernel’s DRM AMDGPU SDMA7.0 code path, where the vulnerable usage was a BUG_ON() that could crash the kernel. It has been fixed by replacing BUG_ON() with WARN_ON(), indicating that such checks should warn rather than crash. Affected component: drm/amdgpu/sdma7.0. Root c...

EUVD-2026-55353

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/sdma7.0: replace BUGON with WARNON There's no need to crash the kernel for these cases. cherry picked from commit 9723a8bed3aa251a26bee4583bac9d8fb064dd44...

CVE-2026-68251 drm/amdgpu/sdma6.0: replace BUG_ON() with WARN_ON()

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/sdma6.0: replace BUGON with WARNON There's no need to crash the kernel for these cases. cherry picked from commit c17a508a7d652da3728f8bbc481bfffe96d65a87...

EUVD-2026-55352

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/sdma6.0: replace BUGON with WARNON There's no need to crash the kernel for these cases. cherry picked from commit c17a508a7d652da3728f8bbc481bfffe96d65a87...

CVE-2026-68251 drm/amdgpu/sdma6.0: replace BUG_ON() with WARN_ON()

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/sdma6.0: replace BUGON with WARNON There's no need to crash the kernel for these cases. cherry picked from commit c17a508a7d652da3728f8bbc481bfffe96d65a87...

CVE-2026-68251

CVE-2026-68251 affects the Linux kernel’s drm/amdgpu/sdma6.0 code. The issue was resolved by replacing a BUG_ON() with WARN_ON(), so kernels will not crash in these cases. The fix is drawn from a cherry-picked commit (c17a508a7d652da3728f8bbc481bfffe96d65a87) and is reflected in multiple stable-t...