CVE-2026-64186

In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Remove latent out-of-bounds access in IOMMU debugfs In iommummiowrite and iommucapabilitywrite, the variables dbgmmiooffset and dbgcapoffset are declared as int. However, they are populated using kstrtou32fromuser. If ...

CVE-2026-64186

CVE-2026-64186 relates to the Linux kernel AMD IOMMU debugfs handling. The issue arises from using int-typed dbg_mmio_offset and dbg_cap_offset populated via kstrtou32_from_user(), which can wrap to a negative value for large inputs, risking out-of-bounds access in read/write paths. The patch fix...

CVE-2026-64186 iommu/amd: Remove latent out-of-bounds access in IOMMU debugfs

In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Remove latent out-of-bounds access in IOMMU debugfs In iommummiowrite and iommucapabilitywrite, the variables dbgmmiooffset and dbgcapoffset are declared as int. However, they are populated using kstrtou32fromuser. If ...

CVE-2026-64097 drm/amd/display: Validate GPIO pin LUT table size before iterating

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Validate GPIO pin LUT table size before iterating Why&How The GPIO pin table parsers in getgpioi2cinfo and biosparsergetgpiopininfo derive an element count from the VBIOS tableheader.structuresize field, then...

EUVD-2026-45782

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Validate GPIO pin LUT table size before iterating Why&How The GPIO pin table parsers in getgpioi2cinfo and biosparsergetgpiopininfo derive an element count from the VBIOS tableheader.structuresize field, then...

CVE-2026-64097

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Validate GPIO pin LUT table size before iterating Why&How The GPIO pin table parsers in getgpioi2cinfo and biosparsergetgpiopininfo derive an element count from the VBIOS tableheader.structuresize field, then...

CVE-2026-63851

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vcn: set nouserfence for VCN v4.0.5 enc ring VCN encoder and decoder rings do not support 64-bit user fence writes, reject CS submissions with user fences. cherry picked from commit...

EUVD-2026-45763

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: check numentries in GEMOP GETMAPPINGINFO kvcallocargs-numentries, sizeofvmentries, GFPKERNEL at amdgpugem.c:1050 uses the user-supplied numentries directly without any upper bounds check. Since numentries is a u32 and...

CVE-2026-63854

CVE-2026-63854 affects the Linux kernel’s DRM amdgpu/vcn path. The issue is that VCN v3.0 encoder/decoder rings do not support 64-bit user fence writes, causing the kernel to reject CS submissions that use user fences. The vulnerability has a CVSS 3.1 base score of 7.8 (HIGH) with local access, l...

EUVD-2026-45533

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vcn: set nouserfence for VCN v5.0.1 enc ring VCN encoder and decoder rings do not support 64-bit user fence writes, reject CS submissions with user fences. cherry picked from commit...

CVE-2026-63847 drm/amdgpu/jpeg: set no_user_fence for JPEG v2.5 ring

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/jpeg: set nouserfence for JPEG v2.5 ring JPEG rings do not support 64-bit user fence writes, reject CS submissions with user fences. cherry picked from commit 3216a7f4e2642bda5fd14f57586e835ae9202587...

CVE-2026-63844

Linux kernel vulnerability (CVE-2026-63844) affecting the AMDGPU JPEG path: JPEG rings (v4.0.3) do not support 64-bit user fence writes, so submissions using user fences are rejected. The fix enables no_user_fence for the JPEG ring, addressing the issue via a cherry-picked commit. Exploitation de...

CVE-2026-63843

The CVE-2026-63843 issue affects the Linux kernel, specifically the drm/amdgpu/jpeg path where JPEG v4.0.5 rings did not support 64-bit user fence writes. The underlying vulnerability arises from enabling user fences for these rings, leading to potential issues when submitting command streams. Th...

CVE-2026-63840 drm/amdgpu/jpeg: set no_user_fence for JPEG v5.3.0 ring

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/jpeg: set nouserfence for JPEG v5.3.0 ring JPEG rings do not support 64-bit user fence writes, reject CS submissions with user fences. cherry picked from commit 86ac011ae234c03fb872f4945913391ea1d8862e...

CVE-2026-63794

In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Fix page overflow in sevdbgcrypt for ENCRYPT path In sevdbgcrypt, the per-iteration transfer length is bounded by the source page offset PAGESIZE - soff but not by the destination page offset PAGESIZE - doff. When doff...

CVE-2026-53376

CVE-2026-53376 fixes an upper bound check in drm/amdkfd (kfd_ioctl_get_process_apertures_new) in the Linux kernel, preventing potential out-of-bounds access. The patch sequence is noted as cherry-picked from commit 98ff46a5ea090c14d2cdb4f5b993b05d74f3949f and has been applied to stable kernels fo...

CVE-2026-53376

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Add upper bound check for numofnodes drm/amdkfd: Add upper bound check for numofnodes in kfdioctlgetprocessaperturesnew. cherry picked from commit 98ff46a5ea090c14d2cdb4f5b993b05d74f3949f...

CVE-2026-53374 drm/amdgpu: zero-initialize GART table on allocation

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: zero-initialize GART table on allocation GART TLB is flushed after unmapping but not after mapping. Since amdgpubocreatekernel does not zero-initialize the buffer, when a single PTE is written the TLB may speculativel...

CVE-2026-64186: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Remove latent out-of-bounds access in IOMMU debugfs In iommummiowrite and iommucapabilitywrite, the variables dbgmmiooffset and dbgcapoffset are declared as int. However, they are populated using kstrtou32fromuser. If ...

PT-2026-61158

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the drm/amdgpu/jpeg component where JPEG v5.0.1 rings do not support 64-bit user fence writes. This leads to a failure to reject Command Stream CS submissions that...