CVE-2026-80541

A vulnerability in the Linux kernel's drm/amdgpu driver allows a local, low-privileged user to trigger a kernel BUG_ON() crash by crafting a GEM_CREATE ioctl with an invalid combination of domain flags (e.g., CPU|GTT|VRAM combined with DOORBELL, GDS, GWS, or OA). The root cause is that while indi...

CVE-2026-80541 drm/amdgpu: validate GEM_CREATE domain combinations

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: validate GEMCREATE domain combinations AMDGPUGEMCREATE checked domain bits against AMDGPUGEMDOMAINMASK, but did not validate domain combinations. Userspace could combine CPU|GTT|VRAM with DOORBELL, GDS, GWS, or OA,...

CVE-2026-80541 drm/amdgpu: validate GEM_CREATE domain combinations

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: validate GEMCREATE domain combinations AMDGPUGEMCREATE checked domain bits against AMDGPUGEMDOMAINMASK, but did not validate domain combinations. Userspace could combine CPU|GTT|VRAM with DOORBELL, GDS, GWS, or OA,...

CVE-2026-80539 drm/amdgpu: disallow multiple FENCE chunks in one submit

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: disallow multiple FENCE chunks in one submit amdgpucspass1 dispatches on chunkid once per chunk without rejecting repeated ids. p-ufbo is a single-slot field, so a submission carrying two AMDGPUCHUNKIDFENCE chunks run...

CVE-2026-80539 drm/amdgpu: disallow multiple FENCE chunks in one submit

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: disallow multiple FENCE chunks in one submit amdgpucspass1 dispatches on chunkid once per chunk without rejecting repeated ids. p-ufbo is a single-slot field, so a submission carrying two AMDGPUCHUNKIDFENCE chunks run...

CVE-2026-80540

CVE-2026-80540 affects the Linux kernel's drm/amdgpu driver , specifically the UVD (Unified Video Decoder) component. The root cause is a faulty minimum-size calculation for decoded images: the code used width instead of pitch , and failed to reject pitch values exceeding 4096, enabling an intege...

CVE-2026-80540 drm/amdgpu: Fix UVD decode image min size calculation

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix UVD decode image min size calculation This needs to use pitch instead of width. Also reject pitch over 4096 to avoid overflow. cherry picked from commit b41c8cb12e202b220353332ab87dc01a11f69304...

CVE-2026-80540 drm/amdgpu: Fix UVD decode image min size calculation

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix UVD decode image min size calculation This needs to use pitch instead of width. Also reject pitch over 4096 to avoid overflow. cherry picked from commit b41c8cb12e202b220353332ab87dc01a11f69304...

CVE-2026-80539

CVE-2026-80539 affects the Linux kernel 's drm/amdgpu driver. In amdgpu_cs_pass1(), a user submission carrying multiple AMDGPU_CHUNK_ID_FENCE chunks causes amdgpu_cs_p1_user_fence() to run more than once. Because p->uf_bo is a single-slot field, each subsequent call overwrites it with a newly ...

CVE-2026-80576: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: reject oversized IBs with per-ring packet limits On GFX rings, amdgpucsp2ib passed user-supplied ibbytes through to ib-lengthdw without a limit, while ringemitib encodes length into packet fields. Oversized values can...

CVE-2026-80542: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix NULL pointer dereference in amdgpudmcrtcsetvblank amdgpudmcrtcsetvblank dereferences acrtcstate-stream when vblank is enabled/queried from DRMIOCTLMODECRTCGETSEQUENCE before a stream is attached to it. BUG:...

PT-2026-82156

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the drm/amdgpu component regarding the minimum size calculation for UVD decode images. The calculation incorrectly uses width instead of pitch, and it fails to reject...

Linux Distros Unpatched Vulnerability : CVE-2026-80539

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/amdgpu: disallow multiple FENCE chunks in one submit amdgpucspass1 dispatches on chunkid once per chunk without rejecting repeated ids. p-ufbo is a...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098721)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098721 advisory. In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Check NULL before accessing WHAT IGT kmscursorlegacy's...

CVE-2026-80539: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: disallow multiple FENCE chunks in one submit amdgpucspass1 dispatches on chunkid once per chunk without rejecting repeated ids. p-ufbo is a single-slot field, so a submission carrying two AMDGPUCHUNKIDFENCE chunks run...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098885)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098885 advisory. In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: zero-initialize GART table on allocation GART TLB is flushed after unmapping but not...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098971)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098971 advisory. In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Limit BO list entry count to prevent resource exhaustion Userspace can pass an...

PT-2026-82192

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description In the drm/amdgpu component, the amdgpu cs p2 ib function fails to limit user-supplied ib bytes when passing them to ib-length dw. Because ring emit ib encodes this length into packet...

Linux Distros Unpatched Vulnerability : CVE-2026-80540

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/amdgpu: Fix UVD decode image min size calculation This needs to use pitch instead of width. Also reject pitch over 4096 to avoid overflow. cherry picked fro...

PT-2026-82155

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the drm/amdgpu component where the amdgpu cs pass1 function fails to reject repeated chunk IDs. When a submission contains multiple AMDGPU CHUNK ID FENCE chunks, the...