SUSE CVE-2026-98910

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Unwind debug trap enable on copytouser failure If kfddbgtrapenable fails while copying runtimeinfo to userspace, it had already activated the trap, set debugtrapenabled, taken an extra process reference, and opened th...

CVE-2026-98910

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Unwind debug trap enable on copytouser failure If kfddbgtrapenable fails while copying runtimeinfo to userspace, it had already activated the trap, set debugtrapenabled, taken an extra process reference, and opened th...

CVE-2026-98910 drm/amdkfd: Unwind debug trap enable on copy_to_user failure

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Unwind debug trap enable on copytouser failure If kfddbgtrapenable fails while copying runtimeinfo to userspace, it had already activated the trap, set debugtrapenabled, taken an extra process reference, and opened th...

DEBIAN-CVE-2026-98169

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential OOB read in smb3enumsnapshots If snapshotarraysize is smaller than GMTTOKENSIZE, smb3enumsnapshots sets retdatalen to sizeofstruct smbsnapshotarray without verifying the actual length of the server's...

CVE-2026-98253

In the Linux kernel, the following vulnerability has been resolved: RDMA/ucma: Serialize join and leave on copytouser failure rdmajoinmulticast queues RoCE work that later reads the ucmamulticast through event-param.ud.privatedata, then listadds the CMA multicast at the head of idpriv-mclist...

ROS-20260928-73-0013

The vulnerability of the copyfromuser and copytouser functions in the arch/sparc/lib/U1memcpy.S module of the Linux operating system is related to the lack of checking the return value. Exploiting this vulnerability could allow a remote attacker to cause a service failure...

CVE-2026-97496 drm/amdkfd: Fix OOB memory exposure in get_wave_state()

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix OOB memory exposure in getwavestate The getwavestate function for v9 trusts cphqdcntlstacksize and cphqdcntlstackoffset values read directly from the MQD, which are written by GPU microcode and fully...

CVE-2026-97496

The Linux kernel contains an out-of-bounds (OOB) memory exposure vulnerability in the drm/amdkfd component within the get_wave_state() function for v9. The root cause is that the function trusts cp_hqd_cntl_stack_size and cp_hqd_cntl_stack_offset values read from the MQD, which are fully attacker...

CVE-2026-97496: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix OOB memory exposure in getwavestate The getwavestate function for v9 trusts cphqdcntlstacksize and cphqdcntlstackoffset values read directly from the MQD, which are written by GPU microcode and fully...

CVE-2026-97496

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix OOB memory exposure in getwavestate The getwavestate function for v9 trusts cphqdcntlstacksize and cphqdcntlstackoffset values read directly from the MQD, which are written by GPU microcode and fully...

DEBIAN-CVE-2026-89996

In the Linux kernel, the following vulnerability has been resolved: dma-buf: dma-heap: don't publish fd before copytouser succeeds DMAHEAPIOCTLALLOC allocates a dma-buf and installs an fd into the caller's fd table via dmabuffd - fdinstall before dmaheapioctl copies the result back to userspace. ...

AZL-101688 CVE-2026-89996 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: dma-buf: dma-heap: don't publish fd before copytouser succeeds DMAHEAPIOCTLALLOC allocates a dma-buf and installs an fd into the caller's fd table via dmabuffd - fdinstall before dmaheapioctl copies the result back to userspace. ...

CVE-2026-89996 dma-buf: dma-heap: don't publish fd before copy_to_user() succeeds

In the Linux kernel, the following vulnerability has been resolved: dma-buf: dma-heap: don't publish fd before copytouser succeeds DMAHEAPIOCTLALLOC allocates a dma-buf and installs an fd into the caller's fd table via dmabuffd - fdinstall before dmaheapioctl copies the result back to userspace. ...

CVE-2026-89996

CVE-2026-89996 affects the Linux kernel 's dma-heap subsystem. In DMA_HEAP_IOCTL_ALLOC, the file descriptor is installed into the caller's fd table via fd_install() before copy_to_user() completes. If copy_to_user() fails, the fd and its underlying dma-buf reference are leaked for the process lif...

CVE-2026-89996 dma-buf: dma-heap: don't publish fd before copy_to_user() succeeds

In the Linux kernel, the following vulnerability has been resolved: dma-buf: dma-heap: don't publish fd before copytouser succeeds DMAHEAPIOCTLALLOC allocates a dma-buf and installs an fd into the caller's fd table via dmabuffd - fdinstall before dmaheapioctl copies the result back to userspace. ...

EUVD-2026-80604

In the Linux kernel, the following vulnerability has been resolved: dma-buf: dma-heap: don't publish fd before copytouser succeeds DMAHEAPIOCTLALLOC allocates a dma-buf and installs an fd into the caller's fd table via dmabuffd - fdinstall before dmaheapioctl copies the result back to userspace. ...

Linux Distros Unpatched Vulnerability : CVE-2026-89996

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - dma-buf: dma-heap: don't publish fd before copytouser succeeds DMAHEAPIOCTLALLOC allocates a dma- buf and installs an fd into the caller's fd table via dmabuffd...

DEBIAN-CVE-2026-89628

In the Linux kernel, the following vulnerability has been resolved: HID: picolcd: clamp eeprom debugfs read to bytes actually received picolcddebugeepromread trusts resp-rawdata2 -- a length byte supplied by the device in its REPORTEEDATA reply -- clamped only to the caller's read count: ret =...

AZL-100241 CVE-2026-89628 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: HID: picolcd: clamp eeprom debugfs read to bytes actually received picolcddebugeepromread trusts resp-rawdata2 -- a length byte supplied by the device in its REPORTEEDATA reply -- clamped only to the caller's read count: ret =...

UBUNTU-CVE-2026-80970

In the Linux kernel, the following vulnerability has been resolved: ALSA: FCP: do not copy out an uninitialised init response fcpioctlinit allocates its response buffer with kmalloc and copies the whole buffer back to userspace: bufsize = init.step0respsize + init.step2respsize; void resp freekfr...