EUVD-2026-80409

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix scope of mqdmgr dereference in pqmdebugfsmqds Reading /sys/kernel/debug/kfd/mqds while a process holds an active KFD queue triggers a NULL pointer dereference because the for loop that calls mqdmgr-debugfsshowmqd ...

CVE-2026-89809

CVE-2026-89809 is a NULL pointer dereference in the Linux kernel's AMD KFD driver (drm/amdkfd). The bug is in the pqm_debugfs_mqds function: a for-loop calling mqd_mgr->debugfs_show_mqd() is incorrectly placed outside the if (pqn->q) block that initializes mqd_mgr. When a process holds a KF...

CVE-2026-89809 drm/amdkfd: fix scope of mqd_mgr dereference in pqm_debugfs_mqds

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix scope of mqdmgr dereference in pqmdebugfsmqds Reading /sys/kernel/debug/kfd/mqds while a process holds an active KFD queue triggers a NULL pointer dereference because the for loop that calls mqdmgr-debugfsshowmqd ...

CVE-2026-89809 drm/amdkfd: fix scope of mqd_mgr dereference in pqm_debugfs_mqds

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix scope of mqdmgr dereference in pqmdebugfsmqds Reading /sys/kernel/debug/kfd/mqds while a process holds an active KFD queue triggers a NULL pointer dereference because the for loop that calls mqdmgr-debugfsshowmqd ...

CVE-2026-89807

A NULL pointer dereference in the Linux kernel's drm/amdkfd driver allows a local user holding CAP_CHECKPOINT_RESTORE to panic the machine. Both create_queue_cpsch() and create_queue_nocpsch() call mqd_mgr->restore_mqd() unconditionally during CRIU restore, with no NULL guard. When restore_mqd...

CVE-2026-89807 drm/amdkfd: guard against NULL restore_mqd in CRIU queue restore

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: guard against NULL restoremqd in CRIU queue restore Both createqueuecpsch and createqueuenocpsch unconditionally call mqdmgr-restoremqd when a CRIU restore is in progress qd != NULL, with no NULL guard. On any system...

CVE-2026-89807 drm/amdkfd: guard against NULL restore_mqd in CRIU queue restore

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: guard against NULL restoremqd in CRIU queue restore Both createqueuecpsch and createqueuenocpsch unconditionally call mqdmgr-restoremqd when a CRIU restore is in progress qd != NULL, with no NULL guard. On any system...

CVE-2026-89802 drm/nouveau/uvmm: fix NULL deref unwinding an OP_MAP_SPARSE op

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/uvmm: fix NULL deref unwinding an OPMAPSPARSE op Each bindjobop is zeroed by kzallocobj in bindjobopfromuop, and the OPMAPSPARSE case in nouveauuvmmbindjobsubmit only creates a region, so op-ops stays NULL for a...

EUVD-2026-80402

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/uvmm: fix NULL deref unwinding an OPMAPSPARSE op Each bindjobop is zeroed by kzallocobj in bindjobopfromuop, and the OPMAPSPARSE case in nouveauuvmmbindjobsubmit only creates a region, so op-ops stays NULL for a...

CVE-2026-89802

CVE-2026-89802 is a NULL pointer dereference in the drm/nouveau/uvmm driver of the Linux kernel . When a NOUVEAU_VM_BIND job contains an OP_MAP_SPARSE operation that is processed successfully, op->ops remains NULL because the sparse-map path only creates a region without allocating ops. If a s...

CVE-2026-89798

CVE-2026-89798 is a race condition in the Linux kernel's rpcrdma (RDMA) module. In rpcrdma_rn_register(), the notification object is inserted into the rd_xa xarray via xa_alloc() before the caller's callback is stored in rn->rn_done. Because notification objects are zero-allocated, a concurren...

EUVD-2026-80398

In the Linux kernel, the following vulnerability has been resolved: rpcrdma: arm rndone before publishing the notification rpcrdmarnregister inserts @rn into rdxa with xaalloc before storing the caller's callback in rn-rndone. The xarray makes @rn reachable to rpcrdmaremoveone, which walks rdxa a...

CVE-2026-89798 rpcrdma: arm rn_done before publishing the notification

In the Linux kernel, the following vulnerability has been resolved: rpcrdma: arm rndone before publishing the notification rpcrdmarnregister inserts @rn into rdxa with xaalloc before storing the caller's callback in rn-rndone. The xarray makes @rn reachable to rpcrdmaremoveone, which walks rdxa a...

DEBIAN-CVE-2026-89784

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: check rpcsockaddr2uaddr return value in rpcbregisterinet4/6 rpcbregisterinet4 and rpcbregisterinet6 store the result of rpcsockaddr2uaddr into map-raddr without checking it for NULL. rpcsockaddr2uaddr returns NULL when it...

AZL-101508 CVE-2026-89784 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: check rpcsockaddr2uaddr return value in rpcbregisterinet4/6 rpcbregisterinet4 and rpcbregisterinet6 store the result of rpcsockaddr2uaddr into map-raddr without checking it for NULL. rpcsockaddr2uaddr returns NULL when it...

CVE-2026-89784

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: check rpcsockaddr2uaddr return value in rpcbregisterinet4/6 rpcbregisterinet4 and rpcbregisterinet6 store the result of rpcsockaddr2uaddr into map-raddr without checking it for NULL. rpcsockaddr2uaddr returns NULL when it...

CVE-2026-89784

CVE-2026-89784 affects the Linux kernel SUNRPC subsystem. The functions rpcb_register_inet4() and rpcb_register_inet6() store the result of rpc_sockaddr2uaddr() into map->r_addr without checking for NULL . When the final kstrdup() inside rpc_sockaddr2uaddr() fails under memory pressure , the u...

CVE-2026-89784 SUNRPC: check rpc_sockaddr2uaddr() return value in rpcb_register_inet4/6

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: check rpcsockaddr2uaddr return value in rpcbregisterinet4/6 rpcbregisterinet4 and rpcbregisterinet6 store the result of rpcsockaddr2uaddr into map-raddr without checking it for NULL. rpcsockaddr2uaddr returns NULL when it...

EUVD-2026-80305

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: check rpcsockaddr2uaddr return value in rpcbregisterinet4/6 rpcbregisterinet4 and rpcbregisterinet6 store the result of rpcsockaddr2uaddr into map-raddr without checking it for NULL. rpcsockaddr2uaddr returns NULL when it...

CVE-2026-89784 SUNRPC: check rpc_sockaddr2uaddr() return value in rpcb_register_inet4/6

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: check rpcsockaddr2uaddr return value in rpcbregisterinet4/6 rpcbregisterinet4 and rpcbregisterinet6 store the result of rpcsockaddr2uaddr into map-raddr without checking it for NULL. rpcsockaddr2uaddr returns NULL when it...