CVE-2026-93178

A missing bounds check in the Linux kernel's drm/amdgpu/pm/powerplay subsystem (SMU7) allows the vddInd and vddcInd fields parsed from VBIOS tables to index into voltage lookup tables without validation, potentially causing out-of-bounds reads with high impact on confidentiality and availability ...

CVE-2026-93177 drm/amdgpu/pm/powerplay: bounds-check voltage index in Vega10 lookup

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/pm/powerplay: bounds-check voltage index in Vega10 lookup vddInd, vddciInd and mvddInd from VBIOS-parsed tables index into vddc, vddci and vddmem lookup tables without bounds checks across nine sites. Return -EINVAL wh...

EUVD-2026-82285

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/pm/powerplay: bounds-check voltage index in Vega10 lookup vddInd, vddciInd and mvddInd from VBIOS-parsed tables index into vddc, vddci and vddmem lookup tables without bounds checks across nine sites. Return -EINVAL wh...

CVE-2026-93176 drm/amd/display: Fix dangling pointer in plane reset function

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix dangling pointer in plane reset function amdgpudmplanedrmplanereset frees the old state before allocating a new one. If kzalloc fails, the function returns without updating the state pointer, leaving a dangli...

CVE-2026-93177

CVE-2026-93177 affects the Linux kernel 's drm/amdgpu/pm/powerplay driver for Vega10 GPUs. The vddInd, vddciInd, and mvddInd indices parsed from VBIOS tables are used to access vddc, vddci, and vddmem lookup tables without bounds checks across nine code sites, allowing an out-of-range index to re...

CVE-2026-93139

CVE-2026-93139 affects the Linux kernel's amdgpu driver , specifically the MES (Micro-Engine Scheduler) component. The root cause is a loop in the hung_queue_db_array that iterated only AMDGPU_MAX_MES_PIPES times, leaving entries uninitialized for multi-XCC GPUs. This results in null pointer dere...

CVE-2026-93139 drm/amdgpu/mes: Fix hung_queue_db_array loop limit for multi-XCC

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/mes: Fix hungqueuedbarray loop limit for multi-XCC The loop iterated only AMDGPUMAXMESPIPES times, leaving entries uninitialized for multi-XCC GPUs. This causes null pointer dereferences when accessing arrays indexed b...

CVE-2026-93139 drm/amdgpu/mes: Fix hung_queue_db_array loop limit for multi-XCC

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/mes: Fix hungqueuedbarray loop limit for multi-XCC The loop iterated only AMDGPUMAXMESPIPES times, leaving entries uninitialized for multi-XCC GPUs. This causes null pointer dereferences when accessing arrays indexed b...

CVE-2026-93068 drm/amd/display: Fix DM I2C teardown race

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix DM I2C teardown race DM I2C adapters can remain visible to userspace while DM teardown is already in progress. A concurrent i2c-dev transfer may then enter amdgpudmi2cxfer after the backing DM state has been...

CVE-2026-90286 drm/amdgpu/gfx6: Use PFP on the compute queues too

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/gfx6: Use PFP on the compute queues too On GFX6, the compute rings use the same CP path as the graphics ring. The only difference is that they don't support draw commands. As opposed to GFX7 and newer which have a...

EUVD-2026-81879

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/gfx6: Use PFP on the compute queues too On GFX6, the compute rings use the same CP path as the graphics ring. The only difference is that they don't support draw commands. As opposed to GFX7 and newer which have a...

CVE-2026-90286

CVE-2026-90286 is a Linux kernel vulnerability in the DRM/AMDGPU GFX6 driver. On GFX6 GPUs, compute rings share the same Command Processor (CP) path as the graphics ring, but the Packet Front-End (PFP) was not being correctly used on compute queues. The fix ensures PFP is used for register writes...

CVE-2026-90286 drm/amdgpu/gfx6: Use PFP on the compute queues too

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/gfx6: Use PFP on the compute queues too On GFX6, the compute rings use the same CP path as the graphics ring. The only difference is that they don't support draw commands. As opposed to GFX7 and newer which have a...

PT-2026-94972

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A dangling pointer issue exists in the amdgpu dm plane drm plane reset function. The function frees the old state before attempting to allocate a new one using kzalloc. If the allocation...

CVE-2026-93178: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/pm/powerplay: bounds-check voltage index in SMU7 lookup vddInd and vddcInd fields from VBIOS-parsed tables are used to index into voltage lookup tables without a bounds check. Return -EINVAL when any index is out of...

PT-2026-94971

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A dangling pointer issue exists in the CRTC reset function. The function amdgpu dm crtc reset state frees the old state before attempting to allocate a new one. If the kzalloc function...

CVE-2026-93177: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/pm/powerplay: bounds-check voltage index in Vega10 lookup vddInd, vddciInd and mvddInd from VBIOS-parsed tables index into vddc, vddci and vddmem lookup tables without bounds checks across nine sites. Return -EINVAL wh...

CVE-2026-93139: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/mes: Fix hungqueuedbarray loop limit for multi-XCC The loop iterated only AMDGPUMAXMESPIPES times, leaving entries uninitialized for multi-XCC GPUs. This causes null pointer dereferences when accessing arrays indexed b...

CVE-2026-90286: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/gfx6: Use PFP on the compute queues too On GFX6, the compute rings use the same CP path as the graphics ring. The only difference is that they don't support draw commands. As opposed to GFX7 and newer which have a...

PT-2026-94974

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the drm/amdgpu/pm/powerplay component where vddInd and vddcInd fields from VBIOS-parsed tables are used to index into voltage lookup tables without a proper bounds...