CVE-2026-68233 drm/vc4: Shut down BO cache timer before teardown

In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Shut down BO cache timer before teardown The BO cache timer callback schedules timework, and timework can rearm the timer through vc4bocachefreeold. vc4bocachedestroy deletes the timer and then cancels the work, which do...

CVE-2026-68233

In the Linux kernel DRM/VC4 subsystem, CVE-2026-68233 addresses a use-after-free-like race where a timer callback (BO cache timer) can be rearmed by time_work during teardown. vc4_bo_cache_destroy() deletes the timer and cancels the work, but the cancelled work can rearm the timer and queue work ...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerabilities have been resolved: drm/panthor: Fixed UAF issues on kernel BO VA nodes. If the MMU is down, panthorvmunmaprange might return an error. We expect the page table to still be updated; if the MMU is blocked, the rest of the GPU should also be blocke...

Linux Distros Unpatched Vulnerability : CVE-2026-68234

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/amdgpu: fix bo-pin leaking in amdgpubocreatereserved amdgpubocreatereserved only allocates a new BO when boptr struct amdgpubo boptr as input parameter is...

UBUNTU-CVE-2026-64517

In the Linux kernel, the following vulnerability has been resolved: drm/xe/gsc: Fix double-free of managed BO in error path The error path in xegscinitposthwconfig explicitly frees a BO allocated with xemanagedbocreatepinmap via xebounpinmapnovm. Since the managed BO already has a devm cleanup...

CVE-2026-64517

In the Linux kernel, the following vulnerability has been resolved: drm/xe/gsc: Fix double-free of managed BO in error path The error path in xegscinitposthwconfig explicitly frees a BO allocated with xemanagedbocreatepinmap via xebounpinmapnovm. Since the managed BO already has a devm cleanup...

SUSE CVE-2026-64516

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vce1: Fix VCE 1 firmware size and offsets The VCPU BO contains the actual FW at an offset, but it was not calculated into the VCPU BO size. Subtract this from the FW size to make sure there is no out of bounds access...

EUVD-2026-48861

In the Linux kernel, the following vulnerability has been resolved: drm/xe/gsc: Fix double-free of managed BO in error path The error path in xegscinitposthwconfig explicitly frees a BO allocated with xemanagedbocreatepinmap via xebounpinmapnovm. Since the managed BO already has a devm cleanup...

CVE-2026-64516

The CVE-2026-64516 issue affects the Linux kernel’s DRM/AMDGPU VCE1 path. Root cause: the VCPU BO size did not account for the actual firmware offset, risking out-of-bounds access; fixes include subtracting the firmware offset from the firmware size, aligning stack and data offsets to the 32K TLB...

CVE-2026-64517 drm/xe/gsc: Fix double-free of managed BO in error path

In the Linux kernel, the following vulnerability has been resolved: drm/xe/gsc: Fix double-free of managed BO in error path The error path in xegscinitposthwconfig explicitly frees a BO allocated with xemanagedbocreatepinmap via xebounpinmapnovm. Since the managed BO already has a devm cleanup...

CVE-2026-64517

In the Linux kernel, the following vulnerability has been resolved: drm/xe/gsc: Fix double-free of managed BO in error path The error path in xegscinitposthwconfig explicitly frees a BO allocated with xemanagedbocreatepinmap via xebounpinmapnovm. Since the managed BO already has a devm cleanup...

CVE-2026-64517

The CVE-2026-64517 entry describes a Linux kernel issue in the DRM/xe/gsc path where the error handling in xe_gsc_init_post_hwconfig() explicitly frees a managed BO with xe_bo_unpin_map_no_vm(), causing a double-free because a devm cleanup action is already registered. The fix is to remove the ex...

PT-2026-64738

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A double-free issue exists in the error path of the xe gsc init post hwconfig function. The function explicitly frees a Buffer Object BO allocated with xe managed bo create pin map using...

kernel: drm/xe/dma-buf: fix UAF with retry loop

A flaw was found in the Linux kernel, specifically within the drm/xe/dma-buf component. This Use-After-Free UAF vulnerability occurs due to an issue in a retry loop, where a buffer object is prematurely freed on error. An attacker could potentially exploit this to cause memory corruption, leading...

CVE-2026-64008

In the Linux kernel, the following vulnerability has been resolved: accel/rocket: fix UAF via dangling GEM handle in createbo rocketioctlcreatebo inserts a GEM handle into the file's IDR via drmgemhandlecreate early on, then performs several operations that can fail sgt allocation, drmmm insert,...

CVE-2026-64098

In the Linux kernel, the following vulnerability has been resolved: drm/virtio: use uninterruptible resv lock for plane updates virtiogpucursorplaneupdate and virtiogpuresourceflush lock the framebuffer BO's dmaresv via virtiogpuarraylockresv and ignore its return value. The function can fail wit...

CVE-2026-64051

In the Linux kernel, the following vulnerability has been resolved: accel/qaic: Add overflow check to remappfnrange during mmap The call to remappfnrange in qaicgemobjectmmap is susceptible to remapping beyond the VMA if the BO is too large. This can cause use after free issues when munmap unmaps...

CVE-2026-64051

The issue is in the Linux kernel’s accel/qaic driver. A bounds check was missing in remap_pfn_range called by qaic_gem_object_mmap, allowing (re)mapping beyond the VMA when the BO is large. This can yield use-after-free if munmap() only unmaps the VMA while extra mappings remain, enabling potenti...

Linux Distros Unpatched Vulnerability : CVE-2026-53356

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/i915/gem: Fix phys BO pread/pwrite with offset sgpage returns struct page pointer not void so the scaling of pread/pwrite is wrong for phys BO and wrong par...

CVE-2026-53356 drm/i915/gem: Fix phys BO pread/pwrite with offset

In the Linux kernel, the following vulnerability has been resolved: drm/i915/gem: Fix phys BO pread/pwrite with offset sgpage returns struct page pointer not void so the scaling of pread/pwrite is wrong for phys BO and wrong parts of BO would be accessed if non-zero offset is used. Last impacted...