CVE-2026-89814

A flaw was found in the Linux kernel's drm/amdgpu component. This vulnerability occurs when a graphics ring is not assigned to a partition, leading to an out-of-bounds array access during SDMA submissions. A local attacker could potentially exploit this to cause a system crash, resulting in a...

CVE-2026-89818

A flaw was found in the Linux kernel's drm/amdgpu/vcn component. An integer overflow vulnerability exists in the decmsg buffer count check. A local attacker could exploit this by providing a specially crafted message, causing the buffer count expression to wrap around. This allows the parser to...

CVE-2026-98914

A flaw was found in the Linux kernel's amdgpu graphics driver. The driver fails to limit the nesting depth during the execution of ATOM command tables, allowing unbounded recursion. A local user could trigger excessive recursion to cause a kernel stack overflow, leading to a system crash and Deni...

CVE-2026-99149

A flaw was found in the AMDGPU graphics driver within the Linux kernel. When memory allocation fails during user pointer memory validation in the amdgpugemuserptrioctl function, the driver immediately returns an error and bypasses required cleanup routines. This issue causes Graphics Execution...

CVE-2026-99148

A flaw was found in the Linux kernel's AMD GPU driver amdgpu. When closing a handle to a shared graphics buffer object, the driver prematurely detaches its eviction fence before verifying whether active references remain. A local user could exploit this vulnerability to trigger the premature...

CVE-2026-99106

A flaw was found in the Linux kernel's AMDGPU driver. This vulnerability allows a local attacker to cause a Denial of Service DoS through kernel memory exhaustion. When command submission operations fail during certain error-handling paths, allocated memory ranges and buffer object references are...

CVE-2026-99119

A flaw was found in the Linux kernel's AMDGPU driver. A local user could exploit this flaw by creating and evicting graphics buffer objects before initializing a user queue, which improperly validates evicted buffers and omits required reference counts. This issue can lead to memory corruption or...

CVE-2026-98997

A flaw was found in the Linux kernel's AMDGPU graphics driver. In the user queue implementation, the driver fails to verify whether a buffer object was designated for queue doorbells before placing it in the doorbell domain. A local user can exploit this vulnerability by submitting a shared memor...

SUSE CVE-2026-99090

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: serialize vblank counter reads against GPU reset The vblank counter callback reads display registers and scanout position without holding resetdomain-sem. During GPU recovery, display commit work can call the callback...

CVE-2026-99149

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix GEM object leak on ENOMEM in userptr ioctl When amdgpuhmmrangealloc fails amdgpugemuserptrioctl returns -ENOMEM right away and skips the cleanup every other error path goes through. The GEM object, the bo-parent...

CVE-2026-99148

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: keep the eviction fence until the last handle is closed amdgpugemobjectclose detaches the user queue eviction fence from the BO before it checks bova-refcount, so closing any handle of a BO removes the fence, even whe...

CVE-2026-99150

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: don't drop the runtime PM reference twice in amdgpugpr amdgpudebugfsgprread drops its runtime PM reference right after reading the wave registers. When copying them to userspace fails, it jumps to the err label, which...

CVE-2026-99119

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/userq: actually validate userq BOs This was supposed to loop over the individual evicted list, as the kernel and alwaysvalid evicted lists were already handled in amdgpuvmvalidate. Without this, BOs that were created a...

CVE-2026-99106

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: free the userptr ranges when a CS fails after parserbos amdgpucsparserbos allocates an HMM range for every userptr entry of the BO list and looks up the user pages. Those ranges are only freed when amdgpucsparserbos...

SUSE CVE-2026-99106

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: free the userptr ranges when a CS fails after parserbos amdgpucsparserbos allocates an HMM range for every userptr entry of the BO list and looks up the user pages. Those ranges are only freed when amdgpucsparserbos...

SUSE CVE-2026-99119

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/userq: actually validate userq BOs This was supposed to loop over the individual evicted list, as the kernel and alwaysvalid evicted lists were already handled in amdgpuvmvalidate. Without this, BOs that were created a...

SUSE CVE-2026-99148

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: keep the eviction fence until the last handle is closed amdgpugemobjectclose detaches the user queue eviction fence from the BO before it checks bova-refcount, so closing any handle of a BO removes the fence, even whe...

SUSE CVE-2026-99149

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix GEM object leak on ENOMEM in userptr ioctl When amdgpuhmmrangealloc fails amdgpugemuserptrioctl returns -ENOMEM right away and skips the cleanup every other error path goes through. The GEM object, the bo-parent...

SUSE CVE-2026-99150

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: don't drop the runtime PM reference twice in amdgpugpr amdgpudebugfsgprread drops its runtime PM reference right after reading the wave registers. When copying them to userspace fails, it jumps to the err label, which...

AZL-111281 CVE-2026-99150 affecting package kernel 6.6.159.1-1

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: don't drop the runtime PM reference twice in amdgpugpr amdgpudebugfsgprread drops its runtime PM reference right after reading the wave registers. When copying them to userspace fails, it jumps to the err label, which...