CVE-2026-74449

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix divide-by-zero in calculatemcachesetting on zero viewport If a plane reaches calculatemcachesetting with a zero-area viewport, calculatemcachesetting exits early with nummcaches == 0 and mvmpgwidth/height == ...

CVE-2026-74450

In the Linux kernel, the following vulnerability has been resolved: drm/amd/pm: fix pptable use-after-free amdgpudpmgetpptable returns a pointer to a driver-owned power table after dropping adev-pm.mutex. The sysfs path then copies from that pointer. A concurrent pptable write can replace and fre...

CVE-2026-74449

The CVE-2026-74449 issue affects the Linux kernel DRM/AMD display path. A zero-area viewport can lead calculate_mcache_setting to exit with num_mcaches == 0 and mvmpg_width/height == 0, causing a divide-by-zero panic (and potential num_mcaches underflow). The fix changes calculate_mcache_setting ...

PT-2026-72284

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the dma fence dedup array function where it returns 1 instead of 0 when called with the num fences variable equal to 0. This behavior occurs because the for-loop body...

Linux Distros Unpatched Vulnerability : CVE-2026-74447

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/amdkfd: fix uint32t overflow in EOP ring buffer size alignment eopringbuffersize in struct queueproperties is a u32. In kfdqueueacquirebuffers the expected...

SUSE CVE-2026-68109

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/sdma7.1: replace BUGON with WARNON There's no need to crash the kernel for these cases. cherry picked from commit c4f230b51cf2d3e7e8b1c800331f3dbed2a9e3f5...

CVE-2026-68447 drm/amdkfd: clamp v9 CRIU control stack checkpoint copy to BO size

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: clamp v9 CRIU control stack checkpoint copy to BO size CRIU checkpoint copies the MQD control stack using cphqdcntlstacksize from hardware without bounding it to the allocated BO region. If the HW field is larger than...

CVE-2026-68430

CVE-2026-68430 affects the Linux kernel, specifically the DRM AMDGPU gfx8 path. The vulnerability arises from an unnecessary BUG_ON() that could crash the kernel; the fix is to drop this BUG_ON() check. The issue was resolved by cherry-picking the corresponding patch (commit 4d7c25208ca612b754f3b...

Linux Distros Unpatched Vulnerability : CVE-2026-68447

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/amdkfd: clamp v9 CRIU control stack checkpoint copy to BO size CRIU checkpoint copies the MQD control stack using cphqdcntlstacksize from hardware without...

CVE-2026-68112

A flaw was found in the drm/amdgpu/gfx9.4.3 component of the Linux kernel. This vulnerability is due to the use of BUGON macros in error handling, which, when triggered by specific error conditions, could cause the kernel to crash. This could result in a Denial of Service DoS for the system...

CVE-2026-68276

A flaw was found in the Linux kernel's drm/amdgpu/gfx component. A local attacker could exploit a buffer overflow vulnerability in the cleaner shader's sysfs path. This occurs because the system incorrectly writes 256 double words dwords into a buffer allocated for only 16 dwords 64 bytes...

CVE-2026-68252

A flaw was found in the drm/amdgpu/sdma7.0 component of the Linux kernel. This vulnerability could lead to a kernel crash, resulting in a Denial of Service DoS. The issue was caused by an improper use of BUGON which has been replaced with WARNON to prevent system instability...

drm/amdgpu: fix division by zero with invalid uvd dimensions

...

drm/amdgpu/gfx9: replace BUG_ON() with WARN_ON()

...

DEBIAN-CVE-2026-68236

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: set newstream to NULL after release In dmupdatecrtcstate, the skipmodeset path releases newstream via dcstreamrelease but does not set the pointer to NULL. If a later error e.g., color management failure triggers...

UBUNTU-CVE-2026-68115

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/gfx10: replace BUGON with WARNON There's no need to crash the kernel for these cases. cherry picked from commit ac6f00beb658239bced4aaed9efbb04a35348d48...

CVE-2026-68108

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vce: fix integer overflow in image size Fix a security vulnerability where malicious VCE command streams with oversized dimensions e.g. 65536×65536 cause 32-bit integer overflow, wrapping the calculated buffer size to ...

UBUNTU-CVE-2026-68112

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/gfx9.4.3: replace BUGON with WARNON There's no need to crash the kernel for these cases. cherry picked from commit 5676593d08998d7a6d9e2d51d6b54b3820e3755c...

CVE-2026-68275

The CVE-2026-68275 entry concerns the Linux kernel DRM/AMDGPU driver. In the AMDGPU GEM GET_MAPPING_INFO path, amdgpu_gem_op_ioctl() looks up the BO in the caller’s VM via amdgpu_vm_bo_find() but does not verify the returned pointer before using it. If no bo_va exists for the BO in that VM (the n...

CVE-2026-68272 drm/amdgpu: validate CP_GFX_SHADOW chunk size in CS pass1

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: validate CPGFXSHADOW chunk size in CS pass1 Add a minimum-length check for the AMDGPUCHUNKIDCPGFXSHADOW chunk in amdgpucspass1, matching the gate already present for the IB, FENCE and BOHANDLES chunk types. The...