UBUNTU-CVE-2026-72095

In the Linux kernel, the following vulnerability has been resolved: dma-fence: Make dmafencededuparray robust against 0-count input dmafencededuparray returns 1 when called with numfences == 0: the for-loop body never executes, j stays at 0, and the final return ++j yields 1. This contradicts bot...

CVE-2026-74357

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix KASAN slab-out-of-bounds in amdgpucoredump ring dump The ring content dump in amdgpucoredump uses two separate loops over adev-rings: the first counts rings with unsignalled fences to size the allocation, and the...

CVE-2026-74357

CVE-2026-74357 (Linux kernel, amdgpu) : The vulnerability arises in the amdgpu_coredump path where two passes over adev->rings[] count and copy ring data using the same skip condition. Because last_seq is updated concurrently by the fence signalling path, rings may transition from signalled to...

CVE-2026-74357 drm/amdgpu: fix KASAN slab-out-of-bounds in amdgpu_coredump ring dump

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix KASAN slab-out-of-bounds in amdgpucoredump ring dump The ring content dump in amdgpucoredump uses two separate loops over adev-rings: the first counts rings with unsignalled fences to size the allocation, and the...

EUVD-2026-59504

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix KASAN slab-out-of-bounds in amdgpucoredump ring dump The ring content dump in amdgpucoredump uses two separate loops over adev-rings: the first counts rings with unsignalled fences to size the allocation, and the...

CVE-2026-74357 drm/amdgpu: fix KASAN slab-out-of-bounds in amdgpu_coredump ring dump

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix KASAN slab-out-of-bounds in amdgpucoredump ring dump The ring content dump in amdgpucoredump uses two separate loops over adev-rings: the first counts rings with unsignalled fences to size the allocation, and the...

CVE-2026-72095

The CVE-2026-72095 issue affects the Linux kernel dma_fence_dedup_array() function, which incorrectly returned 1 for a 0-length input, contradicting the documented contract. The bug could allow a zero local count path to reach a dedup call and dereference an uninitialized fence slot (notably in a...

CVE-2026-72095 dma-fence: Make dma_fence_dedup_array() robust against 0-count input

In the Linux kernel, the following vulnerability has been resolved: dma-fence: Make dmafencededuparray robust against 0-count input dmafencededuparray returns 1 when called with numfences == 0: the for-loop body never executes, j stays at 0, and the final return ++j yields 1. This contradicts bot...

CVE-2026-72095 dma-fence: Make dma_fence_dedup_array() robust against 0-count input

In the Linux kernel, the following vulnerability has been resolved: dma-fence: Make dmafencededuparray robust against 0-count input dmafencededuparray returns 1 when called with numfences == 0: the for-loop body never executes, j stays at 0, and the final return ++j yields 1. This contradicts bot...

EUVD-2026-59053

In the Linux kernel, the following vulnerability has been resolved: dma-fence: Make dmafencededuparray robust against 0-count input dmafencededuparray returns 1 when called with numfences == 0: the for-loop body never executes, j stays at 0, and the final return ++j yields 1. This contradicts bot...

PT-2026-72899

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An integer overflow occurs in the drm/amdkfd component when aligning the EOP ring buffer size. In the kfd queue acquire buffers function, the eop ring buffer size variable within the que...

PT-2026-72793

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix KASAN slab-out-of-bounds in amdgpu coredump ring dump The ring content dump in amdgpu coredump uses two separate loops over adev-rings: the first counts rings with unsignalled fences to size the allocation, and th...

PT-2026-72902

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the drm/amd/pm component. The function amdgpu dpm get pp table returns a pointer to a driver-owned power table after releasing the adev-pm.mutex. If a...

CVE-2026-74357: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix KASAN slab-out-of-bounds in amdgpucoredump ring dump The ring content dump in amdgpucoredump uses two separate loops over adev-rings: the first counts rings with unsignalled fences to size the allocation, and the...

PT-2026-72637

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory corruption issue exists in the kfd criu resume svm function. The cleanup process iterates through the svms-criu svm metadata list and frees each struct criu svm metadata without...

Linux Distros Unpatched Vulnerability : CVE-2026-74450

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/amd/pm: fix pptable use-after-free amdgpudpmgetpptable returns a pointer to a driver-owned power table after dropping adev-pm.mutex. The sysfs path then...

SUSE CVE-2026-68266

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Hold a dma-buf reference for imported BOs An imported dma-buf BO is created as a ttmbotypesg BO whose reservation object is the exporter's dmabuf-resv. The importer, however, only takes a dma-buf reference after a...

SUSE CVE-2026-68272

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: validate CPGFXSHADOW chunk size in CS pass1 Add a minimum-length check for the AMDGPUCHUNKIDCPGFXSHADOW chunk in amdgpucspass1, matching the gate already present for the IB, FENCE and BOHANDLES chunk types. The...

SUSE CVE-2026-68273

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix context pstate override handling There are several problems in the context pstate handling code. The most serious ones are potential use-after-free and NULL pointer dereferences at context initialization time. Bot...

SUSE CVE-2026-68275

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: check amdgpuvmbofind result in GETMAPPINGINFO The AMDGPUGEMOPGETMAPPINGINFO path of amdgpugemopioctl looks up the bova for the buffer object in the caller's VM via amdgpuvmbofind, but uses the returned pointer without...