CVE-2026-68103

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: reject mapping a reserved doorbell to a new queue When creating an user-queue, the user space provides a doorbell BO handle and an offset within the bo to obtain a doorbell. However current implementation using...

EUVD-2026-55335

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix bo-pin leaking in amdgpubocreatereserved amdgpubocreatereserved only allocates a new BO when boptr struct amdgpubo boptr as input parameter is NULL, it simply skips creation when boptr is non-NULL. But it...

CVE-2026-68234

The CVE describes a bug in drm/amdgpu where amdgpu_bo_create_reserved pins and reserves a BO even when a non-NULL pointer is passed, leading to pin_count increments on repeated uses and eventual BO leaks because teardown unpins only once. The fix makes pinning occur only at creation, so repeated ...

EUVD-2026-55322

In the Linux kernel, the following vulnerability has been resolved: media: nuvoton: npcm-video: fix memory leaks in probe and remove npcmvideoprobe allocates the npcmvideo structure with kzallocobj but never frees it on any probe error path or in npcmvideoremove, leaking the allocation on every...

CVE-2026-68221 media: nuvoton: npcm-video: fix memory leaks in probe and remove

In the Linux kernel, the following vulnerability has been resolved: media: nuvoton: npcm-video: fix memory leaks in probe and remove npcmvideoprobe allocates the npcmvideo structure with kzallocobj but never frees it on any probe error path or in npcmvideoremove, leaking the allocation on every...

CVE-2026-68221

The CVE-2026-68221 entry concerns the Linux kernel component media: nuvoton: npcm-video. The issue is memory leaks in npc m_video_probe() where the structure allocated with kzalloc_obj() is not freed on probe error paths or in npcm_video_remove(), leaking on failed probes and normal unbind. It al...

CVE-2026-68221 media: nuvoton: npcm-video: fix memory leaks in probe and remove

In the Linux kernel, the following vulnerability has been resolved: media: nuvoton: npcm-video: fix memory leaks in probe and remove npcmvideoprobe allocates the npcmvideo structure with kzallocobj but never frees it on any probe error path or in npcmvideoremove, leaking the allocation on every...

CVE-2026-68103 drm/amdgpu: reject mapping a reserved doorbell to a new queue

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: reject mapping a reserved doorbell to a new queue When creating an user-queue, the user space provides a doorbell BO handle and an offset within the bo to obtain a doorbell. However current implementation using...

CVE-2026-68103

The CVE-2026-68103 issue affects the Linux kernel drm/amdgpu component. The root cause is the use of xa_store_irq() when creating a user-queue doorbell mapping, which can allow a later queue with the same BO and offset to overwrite an existing queue and doorbell mapping. This can misroute fence I...

EUVD-2026-55484

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: reject mapping a reserved doorbell to a new queue When creating an user-queue, the user space provides a doorbell BO handle and an offset within the bo to obtain a doorbell. However current implementation using...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: “arm64: zynqmp: Add an OP-TEE node to the device tree” This issue has been resolved through the commit 06d22ed6b6635b17551f386b50bb5aaff9b75fbe. OP-TEE logic in U-Boot automatically inserts a reserved-memory node along with the...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: iommufd/selftest: A overflow issue was identified in IOMMUTESTOPADDRESERVED. syzkaller discovered that this could lead to an overflow in the test infrastructure and cause a WARN message by corrupting the reserved interval tree...

CVE-2023-54387

Erroneously reserved under wrong year by automation defect; never assigned...

CVE-2023-54376

Erroneously reserved under wrong year by automation defect; superseded by correct-year CVE...

CVE-2023-54375

Erroneously reserved under wrong year by automation defect; superseded by correct-year CVE...

CVE-2026-71271

Memos' webhook URL validation, isReservedIP internal/webhook/validate.go, checks a candidate IP against a reservedCIDRs list that omits 0.0.0.0/8 and never calls ip.IsUnspecified — unlike the correctly implemented sibling function isInternalIP in internal/httpgetter/htmlmeta.go, which does...

CVE-2026-71272

Memos' webhook dispatch function safeDialContext internal/webhook/webhook.go resolves the target hostname via net.DefaultResolver.LookupHost and validates the resulting IPs against reserved ranges, but then dials net.JoinHostPorthost, port using the original hostname rather than the...

EUVD-2026-53357

Memos' webhook dispatch function safeDialContext internal/webhook/webhook.go resolves the target hostname via net.DefaultResolver.LookupHost and validates the resulting IPs against reserved ranges, but then dials net.JoinHostPorthost, port using the original hostname rather than the...

CVE-2026-71271

The CVE affects Memos server webhook URL validation. The isReservedIP() check validates candidate IPs against a reservedCIDRs list that omits 0.0.0.0/8 and never calls ip.IsUnspecified(), unlike isInternalIP() which does. Linux redirects connections to 0.0.0.0 to loopback (127.0.0.1). An attacker...

EUVD-2026-53356

Memos' webhook URL validation, isReservedIP internal/webhook/validate.go, checks a candidate IP against a reservedCIDRs list that omits 0.0.0.0/8 and never calls ip.IsUnspecified — unlike the correctly implemented sibling function isInternalIP in internal/httpgetter/htmlmeta.go, which does. Becau...