CVE-2026-99148

A flaw in the Linux kernel's AMD GPU driver (amdgpu) allows a local user to trigger premature eviction of in-use memory. The issue occurs because amdgpu_gem_object_close() detaches the user queue eviction fence from a buffer object (BO) before verifying if active references remain. This can lead ...

CVE-2026-99148: Linux: In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: keep the eviction fence until the last…

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: keep the eviction fence until the last handle is closed amdgpugemobjectclose detaches the user queue eviction fence from the BO before it checks bova-refcount, so closing any handle of a BO removes the fence, even whe...

CVE-2026-99150: Linux: In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: don't drop the runtime PM reference…

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: don't drop the runtime PM reference twice in amdgpugpr amdgpudebugfsgprread drops its runtime PM reference right after reading the wave registers. When copying them to userspace fails, it jumps to the err label, which...

UBUNTU-CVE-2026-99148

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: keep the eviction fence until the last handle is closed amdgpugemobjectclose detaches the user queue eviction fence from the BO before it checks bova-refcount, so closing any handle of a BO removes the fence, even whe...

Linux Distros Unpatched Vulnerability : CVE-2026-99148

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/amdgpu: keep the eviction fence until the last handle is closed amdgpugemobjectclose detaches the user queue eviction fence from the BO before it checks...

wake-and-break

Wake and Break A PSP Platform Security Processor exploit for AMD navi31 cards RX 7900 series. Likely adaptable to other adjacent product families as well. It turns off the PSP's firmware signature check, so the card will load unsigned IP firmware SMU, SDMA, MEC, IMU, RLC that it would otherwise...