CVE-2026-80541 drm/amdgpu: validate GEM_CREATE domain combinations

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: validate GEMCREATE domain combinations AMDGPUGEMCREATE checked domain bits against AMDGPUGEMDOMAINMASK, but did not validate domain combinations. Userspace could combine CPU|GTT|VRAM with DOORBELL, GDS, GWS, or OA,...

CVE-2026-80541

A vulnerability in the Linux kernel's drm/amdgpu driver allows a local, low-privileged user to trigger a kernel BUG_ON() crash by crafting a GEM_CREATE ioctl with an invalid combination of domain flags (e.g., CPU|GTT|VRAM combined with DOORBELL, GDS, GWS, or OA). The root cause is that while indi...

CVE-2026-80539 drm/amdgpu: disallow multiple FENCE chunks in one submit

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: disallow multiple FENCE chunks in one submit amdgpucspass1 dispatches on chunkid once per chunk without rejecting repeated ids. p-ufbo is a single-slot field, so a submission carrying two AMDGPUCHUNKIDFENCE chunks run...

CVE-2026-80539

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: disallow multiple FENCE chunks in one submit amdgpucspass1 dispatches on chunkid once per chunk without rejecting repeated ids. p-ufbo is a single-slot field, so a submission carrying two AMDGPUCHUNKIDFENCE chunks run...

CVE-2026-80540

CVE-2026-80540 affects the Linux kernel's drm/amdgpu driver , specifically the UVD (Unified Video Decoder) component. The root cause is a faulty minimum-size calculation for decoded images: the code used width instead of pitch , and failed to reject pitch values exceeding 4096, enabling an intege...

CVE-2026-80540 drm/amdgpu: Fix UVD decode image min size calculation

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix UVD decode image min size calculation This needs to use pitch instead of width. Also reject pitch over 4096 to avoid overflow. cherry picked from commit b41c8cb12e202b220353332ab87dc01a11f69304...

CVE-2026-80539 drm/amdgpu: disallow multiple FENCE chunks in one submit

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: disallow multiple FENCE chunks in one submit amdgpucspass1 dispatches on chunkid once per chunk without rejecting repeated ids. p-ufbo is a single-slot field, so a submission carrying two AMDGPUCHUNKIDFENCE chunks run...

CVE-2026-80540 drm/amdgpu: Fix UVD decode image min size calculation

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix UVD decode image min size calculation This needs to use pitch instead of width. Also reject pitch over 4096 to avoid overflow. cherry picked from commit b41c8cb12e202b220353332ab87dc01a11f69304...

CVE-2026-80539

CVE-2026-80539 affects the Linux kernel 's drm/amdgpu driver. In amdgpu_cs_pass1(), a user submission carrying multiple AMDGPU_CHUNK_ID_FENCE chunks causes amdgpu_cs_p1_user_fence() to run more than once. Because p->uf_bo is a single-slot field, each subsequent call overwrites it with a newly ...

CVE-2026-80540

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix UVD decode image min size calculation This needs to use pitch instead of width. Also reject pitch over 4096 to avoid overflow. cherry picked from commit b41c8cb12e202b220353332ab87dc01a11f69304...

CVE-2026-80538

CVE-2026-80538 affects the XFS filesystem in the Linux kernel. The function xfs_rtginode_ensure() incorrectly treats all errors returned by xfs_rtginode_load() other than -ENOENT as success, which can leave the realtime group inode unset after an I/O, allocation, or corruption error. The growfs u...

CVE-2026-80538 xfs: propagate errors from xfs_rtginode_load

In the Linux kernel, the following vulnerability has been resolved: xfs: propagate errors from xfsrtginodeload xfsrtginodeensure treats every xfsrtginodeload error other than -ENOENT as success. This can leave the realtime group inode unset after an I/O, allocation, or corruption error. Growfs th...

CVE-2026-80538

In the Linux kernel, the following vulnerability has been resolved: xfs: propagate errors from xfsrtginodeload xfsrtginodeensure treats every xfsrtginodeload error other than -ENOENT as success. This can leave the realtime group inode unset after an I/O, allocation, or corruption error. Growfs th...

CVE-2026-80538 xfs: propagate errors from xfs_rtginode_load

In the Linux kernel, the following vulnerability has been resolved: xfs: propagate errors from xfsrtginodeload xfsrtginodeensure treats every xfsrtginodeload error other than -ENOENT as success. This can leave the realtime group inode unset after an I/O, allocation, or corruption error. Growfs th...

CVE-2026-80529

CVE-2026-80529 affects the Linux kernel's XFS filesystem . In xlog_recover_dquot_commit_pass2() , a recovered dquot is validated via xfs_dqblk_verify() ; on failure the function sets error = -EFSCORRUPTED and jumps to out_release , which unconditionally returns 0. This discards the corruption err...

CVE-2026-80529 xfs: don't swallow dquot recovery verification errors

In the Linux kernel, the following vulnerability has been resolved: xfs: don't swallow dquot recovery verification errors xlogrecoverdquotcommitpass2 validates the recovered dquot with xfsdqblkverify and, on failure, sets error = -EFSCORRUPTED and jumps to outrelease. But outrelease unconditional...

CVE-2026-80529

In the Linux kernel, the following vulnerability has been resolved: xfs: don't swallow dquot recovery verification errors xlogrecoverdquotcommitpass2 validates the recovered dquot with xfsdqblkverify and, on failure, sets error = -EFSCORRUPTED and jumps to outrelease. But outrelease unconditional...

CVE-2026-80529 xfs: don't swallow dquot recovery verification errors

In the Linux kernel, the following vulnerability has been resolved: xfs: don't swallow dquot recovery verification errors xlogrecoverdquotcommitpass2 validates the recovered dquot with xfsdqblkverify and, on failure, sets error = -EFSCORRUPTED and jumps to outrelease. But outrelease unconditional...

EUVD-2026-66444

In the Linux kernel, the following vulnerability has been resolved: xfs: don't swallow dquot recovery verification errors xlogrecoverdquotcommitpass2 validates the recovered dquot with xfsdqblkverify and, on failure, sets error = -EFSCORRUPTED and jumps to outrelease. But outrelease unconditional...

CVE-2026-80525 ASoC: SOF: ipc4-topology: Refresh copier IPC payload before widget setup

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc4-topology: Refresh copier IPC payload before widget setup The ipcconfigdata buffer for copier widgets is built once during ipcprepare called from sofpcmsetupconnectedwidgets and cached for reuse. For host copiers...