Linux Distros Unpatched Vulnerability : CVE-2026-80618

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/amdkfd: Avoid double-unpin of DOORBELL/MMIO BOs on free amdgpuamdkfdgpuvmfreememoryofgpu unpinned DOORBELL and MMIO remap BOs which are pinned at allocation...

PT-2026-82918

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Avoid double-unpin of DOORBELL/MMIO BOs on free amdgpu amdkfd gpuvm free memory of gpu unpinned DOORBELL and MMIO remap BOs which are pinned at allocation time before checking whether the BO is still mapped to the GPU...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: drm/amdgpu: The parameters of bo mapping operations need to be clarified. The parameters of amdgpuvmbomap/replacemap/clearingmappings should be verified in a single common place...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: drm/panfrost: Fixed corruption of the shrinker list caused by the madvise IOCTL. Calling the madvise IOCTL twice on BO causes corruption of the memory shrinker list, leading to a kernel crash. This occurs because BO is already on...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: drm/nouveau: Avoid a use-after-free when BO init fails nouveauboinit is backed by ttmboinit and passes its return value back to the caller. In case of failures, ttmboinit invokes the provided destructor, which should...

CVE-2026-74453

A flaw was found in the Linux kernel's drm/vc4 component. The graphics driver's binner buffer object BO reuses memory slots without properly clearing the Tile State Data Array TSDA. This allows the hardware to process stale data from previous jobs, leading to the creation of invalid command strea...

CVE-2026-72358

A flaw was found in the Linux kernel's drm/xe/pt component. During page table walks for binding, specific functions xepthugeptepossible and xeptscan64K do not properly check if a Buffer Object BO has been purged. This oversight can lead to invalid access of an uninitialized cursor, potentially...

CVE-2026-72359

A flaw was found in the Linux kernel's drm/xe graphics driver. A local user could trigger a NULL pointer dereference when querying memory statistics for a buffer object that has been purged. This issue arises because the driver attempts to access a NULL resource, which can lead to a system crash...

Linux Distros Unpatched Vulnerability : CVE-2026-74381

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - gpu: host1x: Allow entries in BO caches to be freed When a buffer object is pinned via host1xbopin with a cache, the resulting mapping is kept in the cache so i...

Linux Distros Unpatched Vulnerability : CVE-2026-72358

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: drm/xe/pt: prevent invalid cursor access for purged BOs During a page table walk for binding...

CVE-2026-74453

CVE-2026-74453 (Linux kernel, drm/vc4) : The issue arises in the VC4 tile binning path where the Tile State Data Array (TSDA) for a job’s tile set is left in the binner’s slot between submissions. A 16 MB binner buffer is split into 512 KB slots; TSDA is at the start of each slot and is used by h...

CVE-2026-74440

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Wait on external BO kernel fences in exec IOCTL Before arming a user job, xeexecioctl only added the VM's dma-resv KERNEL slot as a dependency. That slot covers rebinds and the kernel operations of the VM's private BOs, b...

CVE-2026-74381

In the Linux kernel, the following vulnerability has been resolved: gpu: host1x: Allow entries in BO caches to be freed When a buffer object is pinned via host1xbopin with a cache, the resulting mapping is kept in the cache so it can be reused on subsequent pins. Each mapping held a reference to...

CVE-2026-72358

In the Linux kernel, the following vulnerability has been resolved: drm/xe/pt: prevent invalid cursor access for purged BOs During a page table walk for binding, xeptstagebind explicitly skips initializing the xerescursor for purged BOs, treating them similarly to NULL VMAs by only setting the...

CVE-2026-72359

In the Linux kernel, the following vulnerability has been resolved: drm/xe: fix NPD in bomeminfo When a buffer object is purged, its ttm.resource is set to NULL via the TTM pipeline gutting flow. However, the BO remains in the client's object list until userspace explicitly closes the GEM handle...

UBUNTU-CVE-2026-72358

In the Linux kernel, the following vulnerability has been resolved: drm/xe/pt: prevent invalid cursor access for purged BOs During a page table walk for binding, xeptstagebind explicitly skips initializing the xerescursor for purged BOs, treating them similarly to NULL VMAs by only setting the...

UBUNTU-CVE-2026-74381

In the Linux kernel, the following vulnerability has been resolved: gpu: host1x: Allow entries in BO caches to be freed When a buffer object is pinned via host1xbopin with a cache, the resulting mapping is kept in the cache so it can be reused on subsequent pins. Each mapping held a reference to...

UBUNTU-CVE-2026-72359

In the Linux kernel, the following vulnerability has been resolved: drm/xe: fix NPD in bomeminfo When a buffer object is purged, its ttm.resource is set to NULL via the TTM pipeline gutting flow. However, the BO remains in the client's object list until userspace explicitly closes the GEM handle...

CVE-2026-74381

In the Linux kernel, the following vulnerability has been resolved: gpu: host1x: Allow entries in BO caches to be freed When a buffer object is pinned via host1xbopin with a cache, the resulting mapping is kept in the cache so it can be reused on subsequent pins. Each mapping held a reference to...

CVE-2026-72359

In the Linux kernel, the following vulnerability has been resolved: drm/xe: fix NPD in bomeminfo When a buffer object is purged, its ttm.resource is set to NULL via the TTM pipeline gutting flow. However, the BO remains in the client's object list until userspace explicitly closes the GEM handle...