CVE-2026-68245

A flaw was found in the drm/amdgpu component of the Linux kernel. A use-after-unlock vulnerability exists where a virtual machine VM pointer is dereferenced after its protective lock has been released. This allows the pointer to be modified, potentially leading to memory corruption. An attacker...

CVE-2026-68109

A flaw was found in the Linux kernel, specifically within the drm/amdgpu/sdma7.1 component. This vulnerability occurs when a BUGON macro is triggered, which can lead to an immediate kernel crash. An attacker could potentially exploit this to cause a Denial of Service DoS on the affected system...

CVE-2026-68364 drm/amd/display: Fix ISM dc_lock deadlock during suspend

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix ISM dclock deadlock during suspend Why System hang observed during suspend/resume while video is playing. amdgpudmismdisable is called under dclock and waits for ISM delayed work via disabledelayedworksync. T...

CVE-2026-68276

The CVE affects the Linux kernel driver path drm/amdgpu/gfx. The cleaner shader sysfs path allocated a 16-dword (64-byte) IB but incorrectly filled (align_mask + 1) dwords; with align_mask 0xff, the loop wrote 256 dwords into a 64-byte buffer, causing a kernel page fault. The fix is to fill 16 dw...

EUVD-2026-55377

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/gfx: fix cleaner shader IB buffer overflow The cleaner shader sysfs path allocates a 16-dword 64 byte IB but incorrectly fills alignmask + 1 dwords. On GFX rings alignmask is 0xff, so the loop wrote 256 dwords into a...

EUVD-2026-55376

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: check amdgpuvmbofind result in GETMAPPINGINFO The AMDGPUGEMOPGETMAPPINGINFO path of amdgpugemopioctl looks up the bova for the buffer object in the caller's VM via amdgpuvmbofind, but uses the returned pointer without...

CVE-2026-68273

CVE-2026-68273 affects the drm/amdgpu component in the Linux kernel. The issue concerns context pstate override handling, particularly in amdgpu_ctx_init() and context exit, where the code did not reliably hold the adev->pm.stable_pstate_ctx_lock and could mismanage the stored override state. ...

EUVD-2026-55373

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: validate CPGFXSHADOW chunk size in CS pass1 Add a minimum-length check for the AMDGPUCHUNKIDCPGFXSHADOW chunk in amdgpucspass1, matching the gate already present for the IB, FENCE and BOHANDLES chunk types. The...

CVE-2026-68272

The CVE-2026-68272 affects the Linux kernel DRM/AMDGPU stack. It introduces a minimum-length validation for the AMDGPU_CHUNK_ID_CP_GFX_SHADOW chunk in amdgpu_cs_pass1(), so undersized chunks (length_dw == 0) are now rejected with -EINVAL before pass2 dereferences data. Previously, a zero-size poi...

CVE-2026-68252

The CVE affects the Linux kernel’s DRM AMDGPU SDMA7.0 code path, where the vulnerable usage was a BUG_ON() that could crash the kernel. It has been fixed by replacing BUG_ON() with WARN_ON(), indicating that such checks should warn rather than crash. Affected component: drm/amdgpu/sdma7.0. Root c...

EUVD-2026-55353

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/sdma7.0: replace BUGON with WARNON There's no need to crash the kernel for these cases. cherry picked from commit 9723a8bed3aa251a26bee4583bac9d8fb064dd44...

EUVD-2026-55352

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/sdma6.0: replace BUGON with WARNON There's no need to crash the kernel for these cases. cherry picked from commit c17a508a7d652da3728f8bbc481bfffe96d65a87...

CVE-2026-68251

CVE-2026-68251 affects the Linux kernel’s drm/amdgpu/sdma6.0 code. The issue was resolved by replacing a BUG_ON() with WARN_ON(), so kernels will not crash in these cases. The fix is drawn from a cherry-picked commit (c17a508a7d652da3728f8bbc481bfffe96d65a87) and is reflected in multiple stable-t...

CVE-2026-68250

In the Linux kernel component drm/amdgpu/sdma5.2, CVE-2026-68250 addresses a path where a BUG_ON() could crash the kernel. The vulnerability is resolved by replacing BUG_ON() with WARN_ON(), avoiding a kernel crash in these cases. The fix was cherry-picked from commit ae658afc7f47f6147371ec42cc6b...

CVE-2026-68249

The CVE-2026-68249 entry concerns the Linux kernel component drm/amdgpu/sdma5.0, where a BUG_ON() condition was replaced with WARN_ON() to avoid kernel crashes in these cases. The vulnerability detail is tied to a code fix cherry-picked from commit 8d144a0eb09537055841af48c9e7c2d4cd48e84d0, and t...

EUVD-2026-55350

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/sdma5.0: replace BUGON with WARNON There's no need to crash the kernel for these cases. cherry picked from commit 8d144a0eb09537055841af48c9e7c2d4cd48e84d...

EUVD-2026-55347

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/gfx11: replace BUGON with WARNON There's no need to crash the kernel for these cases. cherry picked from commit daa62107452d2451787c4248ca38fa2d1a0cbefd...

EUVD-2026-55346

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix lifetime issue of amdgpuvmgettaskinfopasid The vm pointer returned from amdgpuvmgetvmfrompasid is only valid while the lock is still being held. Once xaunlockirqrestore is called and returned, the pointer is no...

CVE-2026-68245

CVE-2026-68245 affects the Linux kernel DRM/AMDGPU stack. The vulnerability arises from a lifetime issue where the vm pointer returned by amdgpu_vm_get_vm_from_pasid() remains valid only while a lock is held; after xa_unlock_irqrestore, the pointer is no longer protected, and dereferencing vm-&gt...

CVE-2026-68238

In the Linux kernel, the drm/amdgpu path released the VFCT ACPI table reference via acpi_get_table() without a matching acpi_put_table(), causing a leak on each call. The fix routes all exit paths through a common acpi_put_table() after copying the VBIOS image with kmemdup(), ensuring the VFCT ta...