CVE-2026-97494

A flaw was found in the Linux kernel's AMD GPU driver. The driver fails to validate the size of firmware images before copying them into the Platform Security Processor PSP private buffer. A local user could exploit this vulnerability by loading an oversized or malformed firmware image, triggerin...

CVE-2021-28663

CVE-2021-28663 Una fuga PoC básica para CVE-2021-28663 Detalles internos de la vulnerabilidad de puerta trasera del kernel de Android Esta es una PoC básica para CVE-2021-28663. Un fallo de diseño en el controlador del kernel de GPU Mali para Android. 1. Crear un GPUVA y también hacer mmap para...

CVE-2026-93823

A flaw was found in the Linux kernel's AMD GPU driver amdkfd. A local user with access to the GPU device interface can trigger excessive kernel memory allocation by providing an abnormally large buffer size parameter during an input/output control ioctl request. This issue can exhaust system memo...

CVE-2026-93809

A flaw was found in the Linux kernel's AMD GPU driver amdgpu. A local user with administrative privileges could cause a Denial of Service DoS by unloading the driver module while callbacks are still scheduled. Because the driver does not wait for pending Read-Copy Update RCU callbacks to complete...

kernel: drm/virtio: use uninterruptible resv lock for plane updates

A flaw was found in the Linux kernel's VirtIO GPU Graphics Processing Unit driver. The virtiogpucursorplaneupdate and virtiogpuresourceflush functions fail to properly acquire a required lock, which can lead to a race condition. A local user could exploit this vulnerability by triggering a memory...

CVE-2026-21007-GPU-Driver-ioctl-Race-Condition-Kernel-Memory-Mapping-

CVE-2026-21007 – Condición de carrera en el ioctl del controlador de GPU Mapeo de memoria del kernel Código del programa simulación en C // gpudriversim.c - Simulated GPU driver ioctl with race condition include include include include void gpummap = NULL; sizet mapsize = 0; int locked = 0; void...

nvidia-gpu-security-poc

Controlador de GPU NVIDIA — dos hallazgos que NVIDIA cerró como comportamiento esperado Código de prueba de concepto y evidencia en bruto para dos hallazgos en el controlador de GPU Linux de NVIDIA, ambos reportados a través del VDP de NVIDIA y ambos cerrados por NVIDIA como comportamiento...

kernel: drm/virtio: use uninterruptible resv lock for plane updates

A flaw was found in the Linux kernel's VirtIO GPU Graphics Processing Unit driver. The virtiogpucursorplaneupdate and virtiogpuresourceflush functions fail to properly acquire a required lock, which can lead to a race condition. A local user could exploit this vulnerability by triggering a memory...

CVE-2026-93217

In the Linux kernel, the following vulnerability has been resolved: mm/madvise: skip device-private PMDs in cold and pageout walks madvisecoldorpageoutpterange takes pmdtranshugelock, whose pmdishuge check returns true for a device-private PMD. The subsequent !pmdpresent branch has a VMBUGON...

DEBIAN-CVE-2026-93217

In the Linux kernel, the following vulnerability has been resolved: mm/madvise: skip device-private PMDs in cold and pageout walks madvisecoldorpageoutpterange takes pmdtranshugelock, whose pmdishuge check returns true for a device-private PMD. The subsequent !pmdpresent branch has a VMBUGON...

DEBIAN-CVE-2026-93218

In the Linux kernel, the following vulnerability has been resolved: mm/hugememory: skip device-private PMDs in madvisefreehugepmd madvisefreepterange checks pmdtranshugepmd unlocked, then madvisefreehugepmd takes pmdtranshugelock. pmdishuge returns true for a device-private PMD, so origpmd can be...

CVE-2024-0070-NVIDIA-GPU-Driver--Resonance-Vulnerability

CVE-2024-0070-NVIDIA-GPU-Driver--Resonance-Vulnerability NVIDIA's GPU drivers have a temporal coherence flaw in their memory management. At 587 kHz resonance, the driver's memory pages experience α-decay interference, allowing kernel memory access from user space. NVIDIA GPU α-Resonance Exploit...

CVE-2026-93218 mm/huge_memory: skip device-private PMDs in madvise_free_huge_pmd

In the Linux kernel, the following vulnerability has been resolved: mm/hugememory: skip device-private PMDs in madvisefreehugepmd madvisefreepterange checks pmdtranshugepmd unlocked, then madvisefreehugepmd takes pmdtranshugelock. pmdishuge returns true for a device-private PMD, so origpmd can be...

CVE-2026-93218

The Linux kernel contains a vulnerability in the mm/huge_memory component related to how it handles device-private Page Middle Directories (PMDs). A race condition occurs when an HMM-based GPU driver interacts with madvise(MADV_FREE). Specifically, migrate_vma_pages() can flip a PMD to a device-p...

CVE-2026-93217

The Linux kernel contains a vulnerability in mm/madvise where madvise_cold_or_pageout_pte_range() can trigger a kernel panic. The issue occurs because pmd_is_huge() returns true for device-private PMDs, causing a VM_BUG_ON() assertion to trip when the PMD is not present. This is potentially trigg...

CVE-2026-93217 mm/madvise: skip device-private PMDs in cold and pageout walks

In the Linux kernel, the following vulnerability has been resolved: mm/madvise: skip device-private PMDs in cold and pageout walks madvisecoldorpageoutpterange takes pmdtranshugelock, whose pmdishuge check returns true for a device-private PMD. The subsequent !pmdpresent branch has a VMBUGON...

CVE-2026-93217: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: mm/madvise: skip device-private PMDs in cold and pageout walks madvisecoldorpageoutpterange takes pmdtranshugelock, whose pmdishuge check returns true for a device-private PMD. The subsequent !pmdpresent branch has a VMBUGON...

CVE-2026-93218: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: mm/hugememory: skip device-private PMDs in madvisefreehugepmd madvisefreepterange checks pmdtranshugepmd unlocked, then madvisefreehugepmd takes pmdtranshugelock. pmdishuge returns true for a device-private PMD, so origpmd can be...

UBUNTU-CVE-2026-93218

In the Linux kernel, the following vulnerability has been resolved: mm/hugememory: skip device-private PMDs in madvisefreehugepmd madvisefreepterange checks pmdtranshugepmd unlocked, then madvisefreehugepmd takes pmdtranshugelock. pmdishuge returns true for a device-private PMD, so origpmd can be...

CVE-2026-93217

In the Linux kernel, the following vulnerability has been resolved: mm/madvise: skip device-private PMDs in cold and pageout walks madvisecoldorpageoutpterange takes pmdtranshugelock, whose pmdishuge check returns true for a device-private PMD. The subsequent !pmdpresent branch has a VMBUGON...