EUVD-2026-86040

In the Linux kernel, the following vulnerability has been resolved: drm/amd/pm: bound ppdpmsetpptable memcpy The powerplay path allocates hardcodepptable once with kmemdup..., softpptablesize. memcpy..., size used the sysfs store count up to PAGESIZE with no upper bound, causing heap overflow...

CVE-2026-97427 drm/amd/pm: bound pp_dpm_set_pp_table() memcpy

In the Linux kernel, the following vulnerability has been resolved: drm/amd/pm: bound ppdpmsetpptable memcpy The powerplay path allocates hardcodepptable once with kmemdup..., softpptablesize. memcpy..., size used the sysfs store count up to PAGESIZE with no upper bound, causing heap overflow...

AMD Zynq™ UltraScale+ MPSoC and RFSoC Devices – Secure Boot Bypass via Unbounded DFU Download Requests

CVE Details Refer to Glossary for explanation of terms CVE| CVE Description| CVSS Base Score ---|---|--- CVE-2026-0461| Insufficient boundary validation in the USB boot mode implementation of AMD Zynq™ UltraScale+ MPSoC and RFSoC devices could allow unbounded Device Firmware Upgrade DFU download...

PT-2026-104901

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Avoid DPMS-on for phantom stream Why & How Calling dc update planes and stream separately for stream and its phantom stream causes a NULL pointer dereference, since the phantom is destroyed on the first call. Ski...

AMD Compressonator SDK Vulnerabilities

CVE Details Refer to Glossary for explanation of terms CVE| CVE Description| CVSS Base Score ---|---|--- CVE-2026-40652| An out-of-bounds read condition in the AMD Compressonator SDK could allow a local attacker to supply a specially crafted Truevision Graphics Adapter TGA file to a user or an...

AMD Zynq™ UltraScale+ MPSoC and RFSoC Devices – Secure Boot Bypass via Unbounded DFU Download Requests

CVE Details Refer to Glossary for explanation of terms CVE| CVE Description| CVSS Base Score ---|---|--- CVE-2026-0461| Insufficient boundary validation in the USB boot mode implementation of AMD Zynq™ UltraScale+ MPSoC and RFSoC devices could allow unbounded Device Firmware Upgrade DFU download...

AMD Compressonator SDK Vulnerabilities

CVE Details Refer to Glossary for explanation of terms CVE| CVE Description| CVSS Base Score ---|---|--- CVE-2026-40652| An out-of-bounds read condition in the AMD Compressonator SDK could allow a local attacker to supply a specially crafted Truevision Graphics Adapter TGA file to a user or an...

CVE-2026-97431

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Avoid DPMS-on for phantom stream Why & How Calling dcupdateplanesandstream separately for stream and its phantom stream causes a NULL pointer dereference, since the phantom is destroyed on the first call. Skip th...

Linux Distros Unpatched Vulnerability : CVE-2026-97427

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/amd/pm: bound ppdpmsetpptable memcpy The powerplay path allocates hardcodepptable once with kmemdup..., softpptablesize. memcpy..., size used the sysfs stor...

CVE-2026-97431: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Avoid DPMS-on for phantom stream Why & How Calling dcupdateplanesandstream separately for stream and its phantom stream causes a NULL pointer dereference, since the phantom is destroyed on the first call. Skip th...

PT-2026-98061

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A heap overflow occurs in the powerplay path when the pp dpm set pp table function is called. The issue arises because memcpy uses a sysfs store count for the size parameter without an...

CVE-2026-97427: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: drm/amd/pm: bound ppdpmsetpptable memcpy The powerplay path allocates hardcodepptable once with kmemdup..., softpptablesize. memcpy..., size used the sysfs store count up to PAGESIZE with no upper bound, causing heap overflow...

CVE-2026-97427

In the Linux kernel, the following vulnerability has been resolved: drm/amd/pm: bound ppdpmsetpptable memcpy The powerplay path allocates hardcodepptable once with kmemdup..., softpptablesize. memcpy..., size used the sysfs store count up to PAGESIZE with no upper bound, causing heap overflow...

Linux Distros Unpatched Vulnerability : CVE-2026-97431

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/amd/display: Avoid DPMS-on for phantom stream Why & How Calling dcupdateplanesandstream separately for stream and its phantom stream causes a NULL pointer...

PT-2026-98065

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL pointer dereference occurs when the dc update planes and stream function is called separately for a stream and its associated phantom stream. This happens because the phantom stre...

PT-2026-105000

In the Linux kernel, the following vulnerability has been resolved: drm/amd/pm: bound pp dpm set pp table memcpy The powerplay path allocates hardcode pp table once with kmemdup..., soft pp table size. memcpy..., size used the sysfs store count up to PAGE SIZE with no upper bound, causing heap...

CVE-2026-89820

A flaw was found in the Linux kernel's drm/amd/display component. During a GPU reset, if certain functions fail after acquiring a dclock, the lock is not properly released. This can lead to a dclock leak, causing subsequent attempts to acquire the lock to hang, resulting in a Denial of Service Do...

ROS-20260923-73-0056

The vulnerability of the floattoint function in the drivers/hid/amd-sfh-hid/sfh11/amdsfhdesc.c file of the Linux kernel subsystem for user interface devices’ driver lies in the handling of buffer overflows. Exploiting this vulnerability could allow an attacker to compromise the confidentiality,...

kernel: iommu/amd: Fix clone_alias() to use the original device's devid

A flaw was found in the Linux kernel's IOMMU Input/Output Memory Management Unit AMD driver. The clonealias function incorrectly uses the device ID devid when handling alias devices. This can lead to the propagation of wrong or stale Device Table Entry DTE entries to alias devices, potentially...

kernel: iommu/amd: Fix clone_alias() to use the original device's devid

A flaw was found in the Linux kernel's IOMMU Input/Output Memory Management Unit AMD driver. The clonealias function incorrectly uses the device ID devid when handling alias devices. This can lead to the propagation of wrong or stale Device Table Entry DTE entries to alias devices, potentially...