CVE-2026-78684 vLLM before 0.27.0 Denial of Service via DeepStream Backend

vLLM before 0.27.0 fails to properly classify DeepStream as a GPU backend and omits pixel-limit enforcement in its decode path. Unauthenticated attackers can activate DeepStream at request time to initialize the process-wide GPU decode pool and submit video that bypasses resource controls, causin...

CVE-2026-78684

vLLM before 0.27.0 fails to properly classify DeepStream as a GPU backend and omits pixel-limit enforcement in its decode path. Unauthenticated attackers can activate DeepStream at request time to initialize the process-wide GPU decode pool and submit video that bypasses resource controls, causin...

SUSE CVE-2026-68427

In the Linux kernel, the following vulnerability has been resolved: gpu: host1x: Fix use-after-free in host1xboclearcachedmappings host1xbounpin drops the last reference to the mapping and frees it, so we can't dereference mapping afterwards. The cache itself outlives the mapping, so use the cach...

SUSE CVE-2026-74416

In the Linux kernel, the following vulnerability has been resolved: drm/radeon: fix memory leak in radeonringrestore on lock failure radeonringrestore takes ownership of the data buffer allocated by radeonringbackup. The caller radeongpureset only frees it in the non-restore branch; in the restor...

Security Notice: NVIDIA Rowhammer - August 2026

NVIDIA has released updated guidance regarding Rowhammer mitigations for NVIDIA GPU and SoC products. NVIDIA recommends a defense-in-depth posture, including enabling SYS-ECC and host IOMMU / DMA isolation. See details below. Go to NVIDIA Product Security. Details NVIDIA received follow-on resear...

CVE-2026-79241: Out-of-bounds Read

Out of bounds read in GPU in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-78984: Use of Uninitialized Resource

Uninitialized resource in GPU in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to potentially read memory outside the sandbox via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-78977: Use of Uninitialized Resource

Uninitialized resource in GPU in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. Chromium security severity: Low...

CVE-2026-78986: Use of Uninitialized Resource

Uninitialized resource in GPU in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to potentially obtain cross-origin data via a crafted HTML page. Chromium security severity: High...

CVE-2026-79274: Exposure of Sensitive Information to an Unauthorized Actor

Information leak in GPU in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. Chromium security severity: High...

CVE-2026-79071: Time-of-check Time-of-use (TOCTOU) Race Condition

Race condition in GPU in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Medium...

PT-2026-81274

Name of the Vulnerable Software and Affected Versions vLLM versions prior to 0.27.0 Description The software fails to properly classify DeepStream as a GPU backend, which leads to the omission of pixel-limit enforcement in its decode path. Unauthenticated attackers can activate DeepStream during ...

CVE-2026-78684: Uncontrolled Resource Consumption

vLLM before 0.27.0 fails to properly classify DeepStream as a GPU backend and omits pixel-limit enforcement in its decode path. Unauthenticated attackers can activate DeepStream at request time to initialize the process-wide GPU decode pool and submit video that bypasses resource controls, causin...

CVE-2026-79040: Use of Uninitialized Resource

Uninitialized resource in GPU in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. Chromium security severity: Low...

CVE-2026-79008: Improper Input Validation

Improper input validation in GPU in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-79007: Use of Uninitialized Resource

Uninitialized resource in GPU in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to potentially read memory outside the sandbox via a crafted HTML page. Chromium security severity: Medium...

PT-2026-81801

Name of the Vulnerable Software and Affected Versions Google Chrome on Android versions prior to 152.0.7977.65 Description An out of bounds read occurs in the GPU component, which allows a remote attacker to read memory outside the sandbox by using a specially crafted HTML page. An out of bounds...

PT-2026-81662

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 152.0.7977.65 Description A race condition in the GPU allows a remote attacker who has compromised the renderer process to potentially execute arbitrary code outside the sandbox. This is achieved by using a...

PT-2026-81634

Name of the Vulnerable Software and Affected Versions Google Chrome on Android versions prior to 152.0.7977.65 Description An uninitialized resource in the GPU allows a remote attacker to read memory outside the sandbox by using a crafted HTML page. Recommendations Update Google Chrome on Android...

PT-2026-81605

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 152.0.7977.65 Description An uninitialized resource in the GPU allows a remote attacker who has compromised the renderer process to potentially read memory outside the sandbox by using a crafted HTML page...