339755 matches found
EUVD-2026-103569
In the Linux kernel, the following vulnerability has been resolved: rds: ib: Clear the sg list when mapping an MR fails rdsibmapfrmr stores the caller's scatterlist in the MR before DMA mapping and registration can fail. On failure, rdsrdmamap unpins the pages and frees the scatterlist, but...
CVE-2026-98523 drm/client: fix restore of partially initialized client
In the Linux kernel, the following vulnerability has been resolved: drm/client: fix restore of partially initialized client I got a null-ptr-deref report when closing a DRM file descriptor: WARNING: drivers/gpu/drm/drmatomic.c:2031 at drmatomichelpersetconfig+0x18e/0x1b0 drm Call Trace:...
CVE-2026-98523
The Linux kernel contains a vulnerability in the drm subsystem where a NULL pointer dereference can occur when closing a DRM file descriptor. The issue stems from drm_client_register() adding a client to the device list before the hotplug callback completes; if the callback fails, the client rema...
EUVD-2026-103763
In the Linux kernel, the following vulnerability has been resolved: drm/client: fix restore of partially initialized client I got a null-ptr-deref report when closing a DRM file descriptor: WARNING: drivers/gpu/drm/drmatomic.c:2031 at drmatomichelpersetconfig+0x18e/0x1b0 drm Call Trace:...
CVE-2026-98522 drm/imagination: Propagate map failures correctly from pvr_mmu_map_sgl()
In the Linux kernel, the following vulnerability has been resolved: drm/imagination: Propagate map failures correctly from pvrmmumapsgl Map failure from pvrmmumapsgl interface was not returned correctly to pvrmmumap interface. This resulted in pvrmmumap interface to continue instead of returning ...
EUVD-2026-103762
In the Linux kernel, the following vulnerability has been resolved: drm/imagination: Propagate map failures correctly from pvrmmumapsgl Map failure from pvrmmumapsgl interface was not returned correctly to pvrmmumap interface. This resulted in pvrmmumap interface to continue instead of returning ...
CVE-2026-98522
The Linux kernel contains a vulnerability in the drm/imagination driver where the pvr_mmu_map_sgl() interface failed to correctly propagate map failures to the pvr_mmu_map() interface. This flaw caused pvr_mmu_map() to continue execution instead of returning an error to the caller, potentially le...
CVE-2026-98520 drm/amdkfd: fix use-after-free and multi-container gap in kfd_dev_mapping
In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix use-after-free and multi-container gap in kfddevmapping kfddevmapping caches the addressspace of the first /dev/kfd opener so that the GPU reset path can call unmapmappingrange to zap all userspace mappings of...
CVE-2026-98521 drm/i915: fix incorrect RCU teardown order
In the Linux kernel, the following vulnerability has been resolved: drm/i915: fix incorrect RCU teardown order i915gembusyioctl uses dmaresvforeachfenceunlocked to iterate over the fences in an GEM object without holding a reference but only the RCU read side lock. What can happen here is that th...
EUVD-2026-103761
In the Linux kernel, the following vulnerability has been resolved: drm/i915: fix incorrect RCU teardown order i915gembusyioctl uses dmaresvforeachfenceunlocked to iterate over the fences in an GEM object without holding a reference but only the RCU read side lock. What can happen here is that th...
CVE-2026-98521
The Linux kernel 's drm/i915 driver contains a vulnerability where the i915_gem_busy_ioctl function fails to hold a proper reference while iterating over fences in a GEM object , relying only on the RCU read side lock. This allows a GEM object to be destroyed concurrently, causing dma_resv_for_ea...
EUVD-2026-103760
In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix use-after-free and multi-container gap in kfddevmapping kfddevmapping caches the addressspace of the first /dev/kfd opener so that the GPU reset path can call unmapmappingrange to zap all userspace mappings of...
CVE-2026-98520
The Linux kernel contains a vulnerability in the drm/amdkfd component involving kfd_dev_mapping . The issue stems from caching the address_space of only the first /dev/kfd opener, leading to two primary problems in SRIOV environments with multiple containers: 1) A use-after-free and rwsem deadloc...
CVE-2026-98519 drm/amdgpu: Fix runtime PM leak in amdgpu_debugfs_test_ib_show()
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix runtime PM leak in amdgpudebugfstestibshow amdgpudebugfstestibshow resumes the device with pmruntimegetsync before taking the reset domain semaphore with downwritekillable. If the write lock acquisition is...
EUVD-2026-103759
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix runtime PM leak in amdgpudebugfstestibshow amdgpudebugfstestibshow resumes the device with pmruntimegetsync before taking the reset domain semaphore with downwritekillable. If the write lock acquisition is...
CVE-2026-98519
The Linux kernel 's amdgpu driver contains a runtime PM leak in the amdgpu_debugfs_test_ib_show() function. The issue occurs because the function resumes the device using pm_runtime_get_sync() before acquiring the reset domain semaphore with down_write_killable() . If the write lock acquisition i...
CVE-2026-98518 drm/nouveau/dmem: pin VRAM for the whole registered range
In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/dmem: pin VRAM for the whole registered range Commit c32287471077 "gpu/drm/nouveau: enable THP support for GPU memory migration" grew the device-private region that nouveaudmemchunkalloc registers from DMEMCHUNKSIZE t...
EUVD-2026-103758
In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/dmem: pin VRAM for the whole registered range Commit c32287471077 "gpu/drm/nouveau: enable THP support for GPU memory migration" grew the device-private region that nouveaudmemchunkalloc registers from DMEMCHUNKSIZE t...
CVE-2026-98518
The Linux kernel contains a vulnerability in the drm/nouveau/dmem component related to how it handles VRAM registration. Specifically, commit c32287471077 increased the device-private region registered by nouveau_dmem_chunk_alloc() from DMEM_CHUNK_SIZE to DMEM_CHUNK_SIZE * NR_CHUNKS , but failed ...
CVE-2026-98517
A use-after-free (UAF) vulnerability exists in the Linux kernel 's nouveau driver, specifically within the uvmm component. The issue occurs in nouveau_uvmm_sm() when it calls op_map(), which passes bo->resource to nouveau_uvma_map(). If the Buffer Object (BO) is left in the TTM_PL_SYSTEM state...