425 matches found
CVE-2026-99148
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: keep the eviction fence until the last handle is closed amdgpugemobjectclose detaches the user queue eviction fence from the BO before it checks bova-refcount, so closing any handle of a BO removes the fence, even whe...
CVE-2026-99148 drm/amdgpu: keep the eviction fence until the last handle is closed
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: keep the eviction fence until the last handle is closed amdgpugemobjectclose detaches the user queue eviction fence from the BO before it checks bova-refcount, so closing any handle of a BO removes the fence, even whe...
CVE-2026-99148
The Linux kernel 's amdgpu driver contains a vulnerability where amdgpu_gem_object_close() prematurely detaches the user queue eviction fence from a Buffer Object (BO) before verifying the bo_va->ref_count . This allows a BO to be evicted while other handles or mappings are still in use, poten...
CVE-2026-99148 drm/amdgpu: keep the eviction fence until the last handle is closed
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: keep the eviction fence until the last handle is closed amdgpugemobjectclose detaches the user queue eviction fence from the BO before it checks bova-refcount, so closing any handle of a BO removes the fence, even whe...
EUVD-2026-111900
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: keep the eviction fence until the last handle is closed amdgpugemobjectclose detaches the user queue eviction fence from the BO before it checks bova-refcount, so closing any handle of a BO removes the fence, even whe...
UBUNTU-CVE-2026-99148
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: keep the eviction fence until the last handle is closed amdgpugemobjectclose detaches the user queue eviction fence from the BO before it checks bova-refcount, so closing any handle of a BO removes the fence, even whe...
CVE-2026-99148
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: keep the eviction fence until the last handle is closed amdgpugemobjectclose detaches the user queue eviction fence from the BO before it checks bova-refcount, so closing any handle of a BO removes the fence, even whe...
PT-2026-128141
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: keep the eviction fence until the last handle is closed amdgpu gem object close detaches the user queue eviction fence from the BO before it checks bo va-ref count, so closing any handle of a BO removes the fence, eve...
CVE-2026-99148: Linux: In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: keep the eviction fence until the last…
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: keep the eviction fence until the last handle is closed amdgpugemobjectclose detaches the user queue eviction fence from the BO before it checks bova-refcount, so closing any handle of a BO removes the fence, even whe...
EUVD-2026-108791
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/userq: only accept doorbell BOs as queue doorbell amdgpuuserqgetdoorbellindex pins any BO passed as doorbellhandle into the doorbell domain. For a regular BO, TTM moves it with ttmbomovenull and its contents are lost...
CVE-2026-98970
In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Free the BO cache size list on teardown vc4bocachedestroy purges the cached BOs but never frees the size list, leaking it on every unbind...
PT-2026-121947
In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Free the BO cache size list on teardown vc4 bo cache destroy purges the cached BOs but never frees the size list, leaking it on every unbind...
Unity Linux 20.1020e / 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-142491)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-142491 advisory. In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO size vc4overflowmemwork poin...
PT-2026-116730
Name of the Vulnerable Software and Affected Versions Linux kernel version 7.2.0 Description In the nouveau driver, the nouveau bo pin locked function incorrectly increments the pin count when a re-pin request fails due to incompatible memory domains. Although the function sets an -EBUSY error, i...
PT-2026-116733
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A reference leak occurs in the validate init function within the drm/nouveau component. When a ttm bo reserve failure or a "vma not found" error occurs, the loop terminates without addin...
Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15
In the Linux kernel, the following vulnerabilities have been resolved: drm/amdgpu: Properly unmaps and removes the csava. The root PD BO should be reserved before unmapping and removing the bova from the VM; otherwise, lockdep will report an error. v2: Check that fpriv-csava is not NULL instead o...
Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fixed the issue of BO-pin leaking in amdgpubocreatereserved. The amdgpubocreatereserved function only allocates a new BO when boptr struct amdgpubo boptr as the input parameter is NULL. If boptr is not NULL, the...
Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Fixed a memory leak in the BO array when it is in a hung state. The BO array that is in a hung state is allocated separately using kzalloc in vc4savehangstate, but it is never freed using vc4freehangstate. Add the missin...
SUSE CVE-2026-100077
In the Linux kernel, the following vulnerability has been resolved: drm/msm: Recover HW before retire hung submit During recovery, it is not safe to retire the hung submit before we recover the GPU. Retiring the submit triggers BO free and that can result in GPU pagefaults since the GPU may be...
DEBIAN-CVE-2026-100077
In the Linux kernel, the following vulnerability has been resolved: drm/msm: Recover HW before retire hung submit During recovery, it is not safe to retire the hung submit before we recover the GPU. Retiring the submit triggers BO free and that can result in GPU pagefaults since the GPU may be...