CVE-2026-64527

The CVE-2026-64527 entry describes a Linux kernel issue in drm/hyperv where VMBus packet size is not validated in the receive callback. hyperv_receive_sub() dispatches on msg->vid_hdr.type without knowing the host-written length, leading to a potential read of stale data when copying from hv-&...

EUVD-2026-49039

In the Linux kernel, the following vulnerability has been resolved: drm/hyperv: validate VMBus packet size in receive callback hypervreceivesub reads msg-vidhdr.type and dispatches into one of four message-type branches without knowing how many bytes the host wrote into hv-recvbuf. The completion...

CVE-2026-64527

In the Linux kernel, the following vulnerability has been resolved: drm/hyperv: validate VMBus packet size in receive callback hypervreceivesub reads msg-vidhdr.type and dispatches into one of four message-type branches without knowing how many bytes the host wrote into hv-recvbuf. The completion...

CVE-2026-64524 drm/hyperv: validate resolution_count and fix WIN8 fallback

In the Linux kernel, the following vulnerability has been resolved: drm/hyperv: validate resolutioncount and fix WIN8 fallback A SYNTHVIDRESOLUTIONRESPONSE with resolutioncount 64 walks past the supportedresolutionSYNTHVIDMAXRESOLUTIONCOUNT array in the parse loop. Bound resolutioncount against t...

CVE-2026-64524

The CVE-2026-64524 issue affects the Linux kernel's DRM Hyper-V driver. A SYNTHVID_RESOLUTION_RESPONSE with resolution_count > 64 could bypass the bound check on the supported_resolution array, potentially leading to out-of-bounds behavior during parsing. The fix binds resolution_count to the ...

CVE-2026-64524 drm/hyperv: validate resolution_count and fix WIN8 fallback

In the Linux kernel, the following vulnerability has been resolved: drm/hyperv: validate resolutioncount and fix WIN8 fallback A SYNTHVIDRESOLUTIONRESPONSE with resolutioncount 64 walks past the supportedresolutionSYNTHVIDMAXRESOLUTIONCOUNT array in the parse loop. Bound resolutioncount against t...

EUVD-2026-48861

In the Linux kernel, the following vulnerability has been resolved: drm/xe/gsc: Fix double-free of managed BO in error path The error path in xegscinitposthwconfig explicitly frees a BO allocated with xemanagedbocreatepinmap via xebounpinmapnovm. Since the managed BO already has a devm cleanup...

CVE-2026-64517 drm/xe/gsc: Fix double-free of managed BO in error path

In the Linux kernel, the following vulnerability has been resolved: drm/xe/gsc: Fix double-free of managed BO in error path The error path in xegscinitposthwconfig explicitly frees a BO allocated with xemanagedbocreatepinmap via xebounpinmapnovm. Since the managed BO already has a devm cleanup...

SUSE CVE-2024-53084

In the Linux kernel, the following vulnerability has been resolved: drm/imagination: Break an object reference loop When remaining resources are being cleaned up on driver close, outstanding VM mappings may result in resources being leaked, due to an object reference loop, as shown below, with ea...

SUSE CVE-2026-64231

In the Linux kernel, the following vulnerability has been resolved: drm/msm/dsi: don't dump registers past the mapped region On DSI 6G platforms the IO address space is internally adjusted by iooffset. Later this adjusted address might be used for memory dumping. However the size that is used for...

Linux Distros Unpatched Vulnerability : CVE-2026-64219

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/amd/display: Validate payload length and linkindex in dcprocessdmubauxtransferasync Why&How dcprocessdmubauxtransferasync copies payload-length bytes into a...

PT-2026-64738

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A double-free issue exists in the error path of the xe gsc init post hwconfig function. The function explicitly frees a Buffer Object BO allocated with xe managed bo create pin map using...

PT-2026-64758

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the drm/hyperv component where the hyperv receive sub function processes VMBus packets without verifying the actual number of bytes written by the host into hv-recv bu...

PT-2026-64755

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the drm/hyperv component where a SYNTHVID RESOLUTION RESPONSE containing a resolution count greater than 64 causes the parse loop to read beyond the boundaries of the...

CVE-2026-64219

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Validate payload length and linkindex in dcprocessdmubauxtransferasync Why&How dcprocessdmubauxtransferasync copies payload-length bytes into a 16-byte stack buffer dpaux.data16 guarded only by an ASSERT, which i...

CVE-2026-64215

In the Linux kernel, the following vulnerability has been resolved: drm/msm/a6xx: Check kzalloc return in a8xxhfisendperftable Check the return value of kzalloc to prevent a NULL pointer dereference on allocation failure. Patchwork: https://patchwork.freedesktop.org/patch/721342/...

DEBIAN-CVE-2026-64215

In the Linux kernel, the following vulnerability has been resolved: drm/msm/a6xx: Check kzalloc return in a8xxhfisendperftable Check the return value of kzalloc to prevent a NULL pointer dereference on allocation failure. Patchwork: https://patchwork.freedesktop.org/patch/721342/...

kernel: drm/xe/dma-buf: fix UAF with retry loop

A flaw was found in the Linux kernel, specifically within the drm/xe/dma-buf component. This Use-After-Free UAF vulnerability occurs due to an issue in a retry loop, where a buffer object is prematurely freed on error. An attacker could potentially exploit this to cause memory corruption, leading...

CVE-2026-64219

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Validate payload length and linkindex in dcprocessdmubauxtransferasync Why dcprocessdmubauxtransferasync copies payload-length bytes into a 16-byte stack buffer dpaux.data16 guarded only by an ASSERT, which is a...

CVE-2026-64219 drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Validate payload length and linkindex in dcprocessdmubauxtransferasync Why&How dcprocessdmubauxtransferasync copies payload-length bytes into a 16-byte stack buffer dpaux.data16 guarded only by an ASSERT, which i...