Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix bo-pin leaking in amdgpubocreatereserved amdgpubocreatereserved only allocates a new BO when boptr struct amdgpubo boptr as input parameter is NULL; otherwise, it simply skips creation. However, it unconditionally...

SUSE CVE-2026-99148

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: keep the eviction fence until the last handle is closed amdgpugemobjectclose detaches the user queue eviction fence from the BO before it checks bova-refcount, so closing any handle of a BO removes the fence, even whe...

CVE-2026-99148

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: keep the eviction fence until the last handle is closed amdgpugemobjectclose detaches the user queue eviction fence from the BO before it checks bova-refcount, so closing any handle of a BO removes the fence, even whe...

DEBIAN-CVE-2026-99148

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: keep the eviction fence until the last handle is closed amdgpugemobjectclose detaches the user queue eviction fence from the BO before it checks bova-refcount, so closing any handle of a BO removes the fence, even whe...

UBUNTU-CVE-2026-99148

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: keep the eviction fence until the last handle is closed amdgpugemobjectclose detaches the user queue eviction fence from the BO before it checks bova-refcount, so closing any handle of a BO removes the fence, even whe...

EUVD-2026-111900

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: keep the eviction fence until the last handle is closed amdgpugemobjectclose detaches the user queue eviction fence from the BO before it checks bova-refcount, so closing any handle of a BO removes the fence, even whe...

CVE-2026-99148

A flaw in the Linux kernel's AMD GPU driver (amdgpu) allows a local user to trigger premature eviction of in-use memory. The issue occurs because amdgpu_gem_object_close() detaches the user queue eviction fence from a buffer object (BO) before verifying if active references remain. This can lead ...

CVE-2026-99148 drm/amdgpu: keep the eviction fence until the last handle is closed

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: keep the eviction fence until the last handle is closed amdgpugemobjectclose detaches the user queue eviction fence from the BO before it checks bova-refcount, so closing any handle of a BO removes the fence, even whe...

CVE-2026-99148 drm/amdgpu: keep the eviction fence until the last handle is closed

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: keep the eviction fence until the last handle is closed amdgpugemobjectclose detaches the user queue eviction fence from the BO before it checks bova-refcount, so closing any handle of a BO removes the fence, even whe...

CVE-2026-99148

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: keep the eviction fence until the last handle is closed amdgpugemobjectclose detaches the user queue eviction fence from the BO before it checks bova-refcount, so closing any handle of a BO removes the fence, even whe...

CVE-2026-99148: Linux: In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: keep the eviction fence until the last…

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: keep the eviction fence until the last handle is closed amdgpugemobjectclose detaches the user queue eviction fence from the BO before it checks bova-refcount, so closing any handle of a BO removes the fence, even whe...

PT-2026-128141

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: keep the eviction fence until the last handle is closed amdgpu gem object close detaches the user queue eviction fence from the BO before it checks bo va-ref count, so closing any handle of a BO removes the fence, eve...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 6.2. It arises because after amdgpucsparserbos allocates HMM ranges for each userptr entry in the BO list, it fails to release these ranges when amdgpucspatchjobs, amdgpucsvmhandling, amdgpucssyncrings, or amdgpucssubmit fail early in their...

EUVD-2026-108791

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/userq: only accept doorbell BOs as queue doorbell amdgpuuserqgetdoorbellindex pins any BO passed as doorbellhandle into the doorbell domain. For a regular BO, TTM moves it with ttmbomovenull and its contents are lost...

CVE-2026-98970

In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Free the BO cache size list on teardown vc4bocachedestroy purges the cached BOs but never frees the size list, leaking it on every unbind...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 6.16. It stems from amdgpuuserqgetdoorbellindex failing to verify whether an incoming BO is placed within the doorbell domain; this may result in a regular BO being fixed into the doorbell domain, causing its contents to be lost...

PT-2026-121947

In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Free the BO cache size list on teardown vc4 bo cache destroy purges the cached BOs but never frees the size list, leaking it on every unbind...

Unity Linux 20.1020e / 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-142491)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-142491 advisory. In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO size vc4overflowmemwork poin...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Properly unmap and remove csava The root PD BO should be reserved before unmapping and removing a bova from the VM; otherwise, lockdep will complain. v2: Check that fpriv-csava is not NULL instead of using amdgpumcbp...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Fix memory leak of BO array in hang state The BO array in the hang state is allocated separately using kzalloc in vc4savehangstate, but it is never freed in vc4freehangstate. Add the missing kfree call for the BO array...