2334 matches found
SUSE CVE-2026-53372
In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Block PASID attachment to nested domain with dirty tracking Kernel lacks dirty tracking support on nested domain attached to PASID, fails the attachment early if nesting parent domain is dirty tracking configured,...
CVE-2026-64152
In the Linux kernel, the following vulnerability has been resolved: iommu: Handle unmap error when iommudebug is enabled Sashiko noticed a latent bug where the map error flow called iommuunmap which calls iommudebugunmapbegin/iommudebugunmapend however since this is an error path the map flow nev...
CVE-2026-64153
In the Linux kernel, the following vulnerability has been resolved: drm/msm: Fix iommumapsgtable return value check and avoid WARN Commit "iommu: return full error code from iommumapsgatomic" changed iommumapsgtable to return an ssizet and negative values in error cases, rather than a sizet and a...
CVE-2026-64008
In the Linux kernel, the following vulnerability has been resolved: accel/rocket: fix UAF via dangling GEM handle in createbo rocketioctlcreatebo inserts a GEM handle into the file's IDR via drmgemhandlecreate early on, then performs several operations that can fail sgt allocation, drmmm insert,...
EUVD-2026-45871
In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Remove latent out-of-bounds access in IOMMU debugfs In iommummiowrite and iommucapabilitywrite, the variables dbgmmiooffset and dbgcapoffset are declared as int. However, they are populated using kstrtou32fromuser. If ...
CVE-2026-64186
The CVE concerns the Linux kernel AMD IOMMU debugfs path. The vulnerability stems from using int-typed dbg_mmio_offset and dbg_cap_offset populated via kstrtou32_from_user(), which can wrap to a negative value for large inputs and enable out-of-bounds reads in iommu_mmio_write() and iommu_capabil...
CVE-2026-64186 iommu/amd: Remove latent out-of-bounds access in IOMMU debugfs
In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Remove latent out-of-bounds access in IOMMU debugfs In iommummiowrite and iommucapabilitywrite, the variables dbgmmiooffset and dbgcapoffset are declared as int. However, they are populated using kstrtou32fromuser. If ...
CVE-2026-64186
In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Remove latent out-of-bounds access in IOMMU debugfs In iommummiowrite and iommucapabilitywrite, the variables dbgmmiooffset and dbgcapoffset are declared as int. However, they are populated using kstrtou32fromuser. If ...
CVE-2026-64153 drm/msm: Fix iommu_map_sgtable() return value check and avoid WARN
In the Linux kernel, the following vulnerability has been resolved: drm/msm: Fix iommumapsgtable return value check and avoid WARN Commit "iommu: return full error code from iommumapsgatomic" changed iommumapsgtable to return an ssizet and negative values in error cases, rather than a sizet and a...
EUVD-2026-45838
In the Linux kernel, the following vulnerability has been resolved: drm/msm: Fix iommumapsgtable return value check and avoid WARN Commit "iommu: return full error code from iommumapsgatomic" changed iommumapsgtable to return an ssizet and negative values in error cases, rather than a sizet and a...
CVE-2026-64153
In the Linux kernel drm/msm area, CVE-2026-64153 covers a fix for iommu_map_sgtable() return value handling. The underlying issue arose after a patch changed iommu_map_sg_atomic to return a signed size (ssize_t) and to emit negative values on error, instead of using size_t with zero. Consequently...
CVE-2026-64153 drm/msm: Fix iommu_map_sgtable() return value check and avoid WARN
In the Linux kernel, the following vulnerability has been resolved: drm/msm: Fix iommumapsgtable return value check and avoid WARN Commit "iommu: return full error code from iommumapsgatomic" changed iommumapsgtable to return an ssizet and negative values in error cases, rather than a sizet and a...
CVE-2026-64153
In the Linux kernel, the following vulnerability has been resolved: drm/msm: Fix iommumapsgtable return value check and avoid WARN Commit "iommu: return full error code from iommumapsgatomic" changed iommumapsgtable to return an ssizet and negative values in error cases, rather than a sizet and a...
EUVD-2026-45837
In the Linux kernel, the following vulnerability has been resolved: iommu: Handle unmap error when iommudebug is enabled Sashiko noticed a latent bug where the map error flow called iommuunmap which calls iommudebugunmapbegin/iommudebugunmapend however since this is an error path the map flow nev...
CVE-2026-64152
In the Linux kernel, the following vulnerability has been resolved: iommu: Handle unmap error when iommudebug is enabled Sashiko noticed a latent bug where the map error flow called iommuunmap which calls iommudebugunmapbegin/iommudebugunmapend however since this is an error path the map flow nev...
CVE-2026-64152 iommu: Handle unmap error when iommu_debug is enabled
In the Linux kernel, the following vulnerability has been resolved: iommu: Handle unmap error when iommudebug is enabled Sashiko noticed a latent bug where the map error flow called iommuunmap which calls iommudebugunmapbegin/iommudebugunmapend however since this is an error path the map flow nev...
CVE-2026-64152
CVE-2026-64152 affects the Linux kernel iommu path. The issue arises when an unmap error in the iommu_debug flow occurs in an error path that did not establish the original iommu_debug_map, causing mis-tracing and unbalanced tracking. Fix: move the unmap error handling into iommu_map_nosync() and...
CVE-2026-64152 iommu: Handle unmap error when iommu_debug is enabled
In the Linux kernel, the following vulnerability has been resolved: iommu: Handle unmap error when iommudebug is enabled Sashiko noticed a latent bug where the map error flow called iommuunmap which calls iommudebugunmapbegin/iommudebugunmapend however since this is an error path the map flow nev...
EUVD-2026-45836
In the Linux kernel, the following vulnerability has been resolved: iommupt: Check for missing PAGESIZE in the pgsizebitmap Sashiko pointed out that the driver could drop PAGESIZE from the pgsizebitmap. That is technically allowed but nothing does it, and such an iommudomain would not be used wit...
CVE-2026-64071
The CVE-2026-64071 issue is a use-after-free in the Linux kernel nvme-pci path. In nvme_free_host_mem(), dev->hmb_sgt is freed via dma_free_noncontiguous() but the pointer is not cleared, so a second call in the nvme_probe() error path (nvme_setup_host_mem() succeeds, nvme_set_host_mem() fails...