CVE-2026-23466

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Open-code GGTT MMIO access protection GGTT MMIO access is currently protected by hotplug drmdeventer, which works correctly when the driver loads successfully and is later unbound or unloaded. However, if driver load fail...

CVE-2026-23430 drm/vmwgfx: Don't overwrite KMS surface dirty tracker

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Don't overwrite KMS surface dirty tracker We were overwriting the surface's dirty tracker here causing a memory leak...

CVE-2026-23430 drm/vmwgfx: Don't overwrite KMS surface dirty tracker

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Don't overwrite KMS surface dirty tracker We were overwriting the surface's dirty tracker here causing a memory leak...

PT-2026-30165

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.0.0-rc1-valkyria+ Description A use-after-free issue exists in the Linux kernel related to framebuffers and property blobs when calling drm dev unplug. The issue occurs when dereferencing freed pointers related...

PT-2026-37414

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory leak exists in the drm/vc4 component. When the vc4 save hang state function encounters an early return condition, it fails to free the previously allocated kernel state variable...

intel_fbdev_set_suspend() DoS

The vulnerability of the intelfbdevsetsuspend function in the drivers/gpu/drm/i915/display/intelfbdev.c file of the Direct Rendering Infrastructure DRI driver in the Linux operating system is related to the assignment of the NULL pointer. Exploiting this vulnerability could allow an attacker to...

Direct Rendering Infrastructure AMD Graphics Heap Buffer Overflow DoS

The vulnerability of the dcconstructctx function in the drivers/gpu/drm/amd/display/dc/core/dc.c file of the Direct Rendering Infrastructure DRI driver for AMD graphics cards in Linux operating systems is related to improper memory release memory leak. Exploiting this vulnerability can allow an...

mtk_drm_crtc_create Heap Buffer Overflow DoS

The vulnerability of the mtkdrmcrtccreate function in the drivers/gpu/drm/mediatek/mtkdrmcrtc.c driver for the Direct Rendering Infrastructure DRI of Mediatek graphics cards in Linux operating systems is related to the lack of checking for the return value. Exploiting this vulnerability can allow...

Panthor driver Heap Buffer Overflow DoS

The vulnerability of the panthorfdinfogathergroupsamples function in the drivers/gpu/drm/panthor/panthorsched.c file of the Panthor driver which supports DRM for ARM Mali CSF-based graphics processors in Linux operating systems is related to the reutilization of previously freed memory. Exploitin...

PT-2026-44334

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the msm ioctl gem info get metadata function where it unconditionally returns 0, ignoring error codes stored in ret. This occurs when the user buffer is too small or...

msm_drm_init Heap Buffer Overflow DoS

The vulnerability of the msmdrminit function in the driver/gpu/drm/msm/msmdrv.c file, a part of the Direct Rendering Infrastructure DRI driver for the Linux operating system’s kernel, relates to the assignment of pointers. Exploiting this vulnerability could allow an attacker to cause service...

Panthor driver Heap Buffer Overflow DoS

The vulnerability of the panthorschedunplug function in the drivers/gpu/drm/panthor/panthorsched.c file of the Panthor driver which provides DRM support for ARM Mali CSF-based graphics processors in the Linux operating system is related to the use of memory after deallocation. Exploiting this...

Direct Rendering Infrastructure Kernel Buffer Overflow DoS

The vulnerability of the msmdrmuninit function in the driver/gpu/drm/msm/msmdrv.c file of the Direct Rendering Infrastructure DRI kernel driver of the Linux operating system is related to the assignment of pointers. Exploiting this vulnerability can allow a remote attacker to cause a service...

Linux Kernel DRI DoS

The vulnerability of the mipidsiremovedevicefn function in the drivers/gpu/drm/drmmipidsi.c driver of the Direct Rendering Infrastructure DRI kernel of the Linux operating system is related to the execution of a loop with an unreachable exit condition “Infinite loop”. Exploiting this vulnerabilit...

vmwgfx Heap Buffer Overflow DoS

The vulnerability of the vmwkmsfbcreate function in the drivers/gpu/drm/vmwgfx/vmwgfxkms.c file, a part of the Direct Rendering Infrastructure DRI driver for the Linux kernel, is related to pointer manipulation. Exploiting this vulnerability could allow an attacker to cause a service failure...

drm/vmwgfx: Return the correct value in vmw_translate_ptr functions

...

panfrost_ioctl_madvise Use-After-Free

The vulnerability of the panfrostioctlmadvise function in the drivers/gpu/drm/panfrost/panfrostdrv.c driver module related to the Linux kernel’s Direct Rendering Infrastructure DRI support mechanism is associated with improper cleaning or release of resources. Exploiting this vulnerability could...

AMD GPU DRI DoS

The vulnerability of the commitminimaltransitionbasedoncurrentcontext function in the drivers/gpu/drm/amd/display/dc/core/dc.c file of the Direct Rendering Infrastructure DRI driver for AMD GPU-based Linux operating system kernels is related to the execution of operations outside of the buffer in...

intel_context_find-active_request Heap Buffer Overflow DoS

The vulnerability of the intelcontextfind-activerequest function in the drivers/gpu/drm/i915/gt/intelcontext.c module of the DRI support driver for the Linux operating system is related to errors during link counter updates. Exploiting this vulnerability could allow an attacker to cause a service...

CVE-2026-23317

A flaw was found in the drm/vmwgfx component of the Linux kernel. Incorrect error handling in the vmwtranslateptr functions could cause them to return a success status even when an internal lookup operation failed. This could lead to the use of uninitialized pointers and out-of-bounds OOB memory...