CVE-2026-99261

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: correct reservation fence slots for userq per-vm BOs eviction It fixes both the move overflow and the eviction fence add for evicting these per-vm BOs...

EUVD-2026-115772

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: correct reservation fence slots for userq per-vm BOs eviction It fixes both the move overflow and the eviction fence add for evicting these per-vm BOs...

CVE-2026-99261 drm/amdgpu: correct reservation fence slots for userq per-vm BOs eviction

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: correct reservation fence slots for userq per-vm BOs eviction It fixes both the move overflow and the eviction fence add for evicting these per-vm BOs...

CVE-2026-99261

The Linux kernel contains a vulnerability in the drm/amdgpu driver related to userq per-vm BOs eviction . The issue involves a move overflow and an eviction fence add error when evicting these per-vm Base Objects (BOs). The fix ensures that reservation fence slots are correctly handled during the...

CVE-2026-89827

A flaw was found in the Linux kernel's drm/amdgpu component. The uvdv70swinit function, responsible for initializing the UVD Unified Video Decoder ring, does not properly set up the decode ring for an SR-IOV Single Root I/O Virtualization Virtual Function VF. This can lead to the amdgpuuvdresume...

PT-2026-136097

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: correct reservation fence slots for userq per-vm BOs eviction It fixes both the move overflow and the eviction fence add for evicting these per-vm BOs...

CVE-2026-89814

A flaw was found in the Linux kernel's drm/amdgpu component. This vulnerability occurs when a graphics ring is not assigned to a partition, leading to an out-of-bounds array access during SDMA submissions. A local attacker could potentially exploit this to cause a system crash, resulting in a...

CVE-2026-89818

A flaw was found in the Linux kernel's drm/amdgpu/vcn component. An integer overflow vulnerability exists in the decmsg buffer count check. A local attacker could exploit this by providing a specially crafted message, causing the buffer count expression to wrap around. This allows the parser to...

SUSE CVE-2026-99090

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: serialize vblank counter reads against GPU reset The vblank counter callback reads display registers and scanout position without holding resetdomain-sem. During GPU recovery, display commit work can call the callback...

CVE-2026-99150

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: don't drop the runtime PM reference twice in amdgpugpr amdgpudebugfsgprread drops its runtime PM reference right after reading the wave registers. When copying them to userspace fails, it jumps to the err label, which...

CVE-2026-99148

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: keep the eviction fence until the last handle is closed amdgpugemobjectclose detaches the user queue eviction fence from the BO before it checks bova-refcount, so closing any handle of a BO removes the fence, even whe...

CVE-2026-99149

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix GEM object leak on ENOMEM in userptr ioctl When amdgpuhmmrangealloc fails amdgpugemuserptrioctl returns -ENOMEM right away and skips the cleanup every other error path goes through. The GEM object, the bo-parent...

CVE-2026-99119

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/userq: actually validate userq BOs This was supposed to loop over the individual evicted list, as the kernel and alwaysvalid evicted lists were already handled in amdgpuvmvalidate. Without this, BOs that were created a...

CVE-2026-99106

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: free the userptr ranges when a CS fails after parserbos amdgpucsparserbos allocates an HMM range for every userptr entry of the BO list and looks up the user pages. Those ranges are only freed when amdgpucsparserbos...

SUSE CVE-2026-99106

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: free the userptr ranges when a CS fails after parserbos amdgpucsparserbos allocates an HMM range for every userptr entry of the BO list and looks up the user pages. Those ranges are only freed when amdgpucsparserbos...

SUSE CVE-2026-99119

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/userq: actually validate userq BOs This was supposed to loop over the individual evicted list, as the kernel and alwaysvalid evicted lists were already handled in amdgpuvmvalidate. Without this, BOs that were created a...

SUSE CVE-2026-99148

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: keep the eviction fence until the last handle is closed amdgpugemobjectclose detaches the user queue eviction fence from the BO before it checks bova-refcount, so closing any handle of a BO removes the fence, even whe...

SUSE CVE-2026-99149

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix GEM object leak on ENOMEM in userptr ioctl When amdgpuhmmrangealloc fails amdgpugemuserptrioctl returns -ENOMEM right away and skips the cleanup every other error path goes through. The GEM object, the bo-parent...

SUSE CVE-2026-99150

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: don't drop the runtime PM reference twice in amdgpugpr amdgpudebugfsgprread drops its runtime PM reference right after reading the wave registers. When copying them to userspace fails, it jumps to the err label, which...

DEBIAN-CVE-2026-99150

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: don't drop the runtime PM reference twice in amdgpugpr amdgpudebugfsgprread drops its runtime PM reference right after reading the wave registers. When copying them to userspace fails, it jumps to the err label, which...