CVE-2023-22906

CVE-2023-22906 CVE-2023-22906 is a critical vulnerability that affects the Hero Qubo Smart Doorbell device running version HCD0102V1.3820220125. This particular device allows Telnet access with root privileges by default, without requiring a password. This vulnerability poses a significant securi...

CVE-2026-98997

A flaw was found in the Linux kernel's AMDGPU graphics driver. In the user queue implementation, the driver fails to verify whether a buffer object was designated for queue doorbells before placing it in the doorbell domain. A local user can exploit this vulnerability by submitting a shared memor...

UBUNTU-CVE-2026-98997

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/userq: only accept doorbell BOs as queue doorbell amdgpuuserqgetdoorbellindex pins any BO passed as doorbellhandle into the doorbell domain. For a regular BO, TTM moves it with ttmbomovenull and its contents are lost...

CVE-2026-98997

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/userq: only accept doorbell BOs as queue doorbell amdgpuuserqgetdoorbellindex pins any BO passed as doorbellhandle into the doorbell domain. For a regular BO, TTM moves it with ttmbomovenull and its contents are lost...

EUVD-2026-108791

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/userq: only accept doorbell BOs as queue doorbell amdgpuuserqgetdoorbellindex pins any BO passed as doorbellhandle into the doorbell domain. For a regular BO, TTM moves it with ttmbomovenull and its contents are lost...

PT-2026-121974

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/userq: only accept doorbell BOs as queue doorbell amdgpu userq get doorbell index pins any BO passed as doorbell handle into the doorbell domain. For a regular BO, TTM moves it with ttm bo move null and its contents ar...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: irqchip/gic-v4: Do not allow a VMOVP operation on a VPE that is already being unmapped, when the corresponding doorbell interrupt is still visible in /proc/irq/. Kunkun Jiang reported that there is a small window of opportunity f...

CVE-2026-98277

In the Linux kernel, the following vulnerability has been resolved: eth: fbnic: ring the doorbell if a burst ends in a drop fbnictxmap skips the doorbell write, and the completion request, for every packet handed to it with xmitmore set, counting on the packet which ends the burst to publish them...

UBUNTU-CVE-2026-98277

In the Linux kernel, the following vulnerability has been resolved: eth: fbnic: ring the doorbell if a burst ends in a drop fbnictxmap skips the doorbell write, and the completion request, for every packet handed to it with xmitmore set, counting on the packet which ends the burst to publish them...

EUVD-2026-93205

In the Linux kernel, the following vulnerability has been resolved: eth: fbnic: ring the doorbell if a burst ends in a drop fbnictxmap skips the doorbell write, and the completion request, for every packet handed to it with xmitmore set, counting on the packet which ends the burst to publish them...

CVE-2026-98277

The Linux kernel contains a vulnerability in the fbnic driver where the fbnic_tx_map() function fails to ring the doorbell or issue a completion request for packets in a burst if the final packet in that burst is dropped (e.g., due to skb_put_padto(), skb_cow_head(), or a DMA mapping failure). Th...

CVE-2026-98277

In the Linux kernel, the following vulnerability has been resolved: eth: fbnic: ring the doorbell if a burst ends in a drop fbnictxmap skips the doorbell write, and the completion request, for every packet handed to it with xmitmore set, counting on the packet which ends the burst to publish them...

CVE-2026-98277 eth: fbnic: ring the doorbell if a burst ends in a drop

In the Linux kernel, the following vulnerability has been resolved: eth: fbnic: ring the doorbell if a burst ends in a drop fbnictxmap skips the doorbell write, and the completion request, for every packet handed to it with xmitmore set, counting on the packet which ends the burst to publish them...

CVE-2026-98277 eth: fbnic: ring the doorbell if a burst ends in a drop

In the Linux kernel, the following vulnerability has been resolved: eth: fbnic: ring the doorbell if a burst ends in a drop fbnictxmap skips the doorbell write, and the completion request, for every packet handed to it with xmitmore set, counting on the packet which ends the burst to publish them...

CVE-2026-98277: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: eth: fbnic: ring the doorbell if a burst ends in a drop fbnictxmap skips the doorbell write, and the completion request, for every packet handed to it with xmitmore set, counting on the packet which ends the burst to publish them...

PT-2026-106606

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.10-1.1 Description An issue exists in the fbnic tx map function where the system skips the doorbell write and completion request for packets marked with xmit more, expecting the final packet of a burst to...

CVE-2026-97495

A flaw was found in the Linux kernel's AMD GPU driver amdkfd. A local user could exploit this vulnerability to cause a Denial of Service DoS or kernel memory corruption by supplying an out-of-bounds doorbell identifier during queue allocation. The issue occurs because the doorbell allocation...

PT-2026-98114

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the drm/amdkfd component where the allocate doorbell function fails to perform bounds checking on the doorbell ID. This occurs when the doorbell ID is set to a specifi...

PT-2026-104988

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Check bounds on allocate doorbell allocated doorbell has an option to set the doorbell id to a specific value used by CRIU. This value was not bounds checked. Check to confirm it's less than KFD MAX NUM OF QUEUES PER...

CVE-2026-17051

The Intel SEDI IPM inter-processor mailbox driver in drivers/ipm/ipmsedi.c handles an inbound message interrupt in ipmeventdispose. It read the peer-written doorbell register, extracted the payload length with IPCHEADERGETLENGTH, and passed that length straight to sediipcreadmsg to copy the messa...