EUVD-2026-48994

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Don't leak PFN when kvmtranslatevncr races MMU notifier In the case that kvmtranslatevncr races with an MMU notifier the early return does not release a reference on the faulted in PFN. Add the necessary call to...

CVE-2026-64269

The CVE-2026-64269 issue affects the Linux kernel’s RDMA path (RDMA/rtrs-srv) where rdma_write_sg() uses desc[0].len from the wire descriptor to determine the RDMA_WRITE length. The length could exceed the bound of the mapped chunk because it wasn’t checked against max_chunk_size, enabling a peer...

kernel: KVM: x86: Check for invalid/obsolete root *after* making MMU pages available

A flaw was found in KVM in the Linux kernel. This vulnerability occurs due to improper validation of memory management unit MMU page roots after these pages are made available. An attacker could exploit this by triggering a scenario where KVM attempts to map memory into an invalid root, causing...

kernel: KVM: x86: Check for invalid/obsolete root *after* making MMU pages available

A flaw was found in KVM in the Linux kernel. This vulnerability occurs due to improper validation of memory management unit MMU page roots after these pages are made available. An attacker could exploit this by triggering a scenario where KVM attempts to map memory into an invalid root, causing...

CVE-2026-64153

A flaw was found in the drm/msm Direct Rendering Manager / Qualcomm MSM driver within the Linux kernel. This vulnerability arises from an incorrect handling of return values in the iommumapsgtable function. Previously, the function would trigger a warning instead of properly returning an error wh...

CVE-2026-64152

A flaw was found in the Linux kernel's Input/Output Memory Management Unit IOMMU subsystem when iommudebug is enabled. This issue occurs because an error handling path attempts to unmap memory without a proper initial mapping, leading to an inconsistent state within the IOMMU's debugging and...

CVE-2026-63807

A flaw was found in the Linux kernel's Kernel-based Virtual Machine KVM x86 memory management unit MMU. A malicious guest operating system could create a hugepage mapping that extends beyond the boundaries of its allocated memory slot. This improper handling of memory boundaries by KVM can lead t...

CVE-2026-53372

A flaw was found in the Linux kernel's Input/Output Memory Management Unit IOMMU subsystem. This vulnerability arises in virtualized environments when a nested domain attempts to attach to a Process Address Space ID PASID, a mechanism for devices to access memory, while its parent domain is...

PT-2026-61123

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds access issue exists in the KVM x86 MMU when recovering hugepages in the shadow MMU. The system fails to verify if the base guest frame number gfn of the shadow page is...

PT-2026-61469

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A latent bug exists in the IOMMU Input-Output Memory Management Unit subsystem when iommu debug is enabled. The issue occurs during the map error flow where iommu unmap is called,...

EUVD-2026-43037

Software installed and run as a non-privileged user may conduct a sequence of improper GPU system calls causing use after free, which helps in facilitating unprivileged memory access from a shader code. Triggering failure path in the MMU mapping logic by a malicious code could lead to incomplete...

CVE-2026-7639

Software installed and run as a non-privileged user may conduct a sequence of improper GPU system calls causing use after free, which helps in facilitating unprivileged memory access from a shader code. Triggering failure path in the MMU mapping logic by a malicious code could lead to incomplete...

CVE-2026-53359 KVM: x86: Fix shadow paging use-after-free due to unexpected role

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Fix shadow paging use-after-free due to unexpected role Commit 0cb2af2ea66ad "KVM: x86: Fix shadow paging use-after-free due to unexpected GFN" fixed a shadow paging mismatch between stored and computed GFNs; the bug...

CVE-2026-53312

A flaw was found in the Linux kernel's IOMMU Input/Output Memory Management Unit component for RISC-V architectures. An integer overflow in the invalidation path can lead to an infinite loop. This vulnerability could allow a local attacker to cause a Denial of Service DoS by triggering the overfl...

SUSE CVE-2026-53280

In the Linux kernel, the following vulnerability has been resolved: iommu: Fix NULL group-domain dereference in pcidevresetiommudone Local sashiko review pointed it out that group-domain could be NULL when a default domain fails to allocate during the first probe, which can crash at...

UBUNTU-CVE-2026-53281

In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Avoid NULL pointer dereference or refcount corruption Commit 60f030f7418d "iommu/vt-d: Avoid use of NULL after WARNONONCE" fixed a NULL pointer dereference in an unlikely situation partly. If devpasid is not found in...

EUVD-2026-39888

In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Bounds-check devid in rlookupamdiommu iommudeviceregister walks every device on the PCI bus via busforeachdev and calls amdiommuprobedevice for each. The inlined checkdevice path computes the device's sbdf, calls...

EUVD-2026-39886

In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Avoid NULL pointer dereference or refcount corruption Commit 60f030f7418d "iommu/vt-d: Avoid use of NULL after WARNONONCE" fixed a NULL pointer dereference in an unlikely situation partly. If devpasid is not found in...

EUVD-2026-39885

In the Linux kernel, the following vulnerability has been resolved: iommu: Fix NULL group-domain dereference in pcidevresetiommudone Local sashiko review pointed it out that group-domain could be NULL when a default domain fails to allocate during the first probe, which can crash at...

UBUNTU-CVE-2026-53133

In the Linux kernel, the following vulnerability has been resolved: RDMA/umem: Fix truncation for block sizes = 4G When the iommu is used the linearization of the mapping can give a single block that is very large split across multiple SG entries. When rdmablockiternext reassembles the split SG...