kernel: drm/amdgpu: fix amdgpu_hmm_range_get_pages

A flaw was found in the Linux kernel, specifically within the drm/amdgpu component. This vulnerability arises from incorrect handling of a notifier sequence in the amdgpuhmmrangegetpages function, where the sequence can be read more than once. This can lead to the system processing invalid memory...

kernel: drm/amdgpu: fix amdgpu_hmm_range_get_pages

A flaw was found in the Linux kernel, specifically within the drm/amdgpu component. This vulnerability arises from incorrect handling of a notifier sequence in the amdgpuhmmrangegetpages function, where the sequence can be read more than once. This can lead to the system processing invalid memory...

CVE-2026-68430

CVE-2026-68430 affects the Linux kernel, specifically the DRM AMDGPU gfx8 path. The vulnerability arises from an unnecessary BUG_ON() that could crash the kernel; the fix is to drop this BUG_ON() check. The issue was resolved by cherry-picking the corresponding patch (commit 4d7c25208ca612b754f3b...

CVE-2026-68107

A flaw was found in the Linux kernel. Specifically, within the drm/amdgpu/vcn4 component, a time-of-check to time-of-use TOCTOU vulnerability exists. This occurs because the system re-reads the IB parameter length instead of reusing an already obtained value. This could allow a local attacker to...

CVE-2026-68102

A flaw was found in the Linux kernel's drm/amdgpu component, which manages AMD graphics hardware. When the graphics driver is unloaded, it may fail to properly release a memory resource. This oversight can lead to system instability if the driver attempts to reload, causing an error that prevents...

CVE-2026-68275

A flaw was found in the drm/amdgpu component of the Linux kernel. A local attacker, with the ability to issue ioctl commands to the render group, could trigger a null pointer dereference by requesting mapping information for an unmapped buffer object. This could lead to a system crash, resulting ...

CVE-2026-68272

A flaw was found in the Linux kernel's drm/amdgpu component. An unprivileged local attacker can exploit this vulnerability by submitting a specially crafted command with a zero-length chunk size for CPGFXSHADOW. This leads to improper memory access within the kernel, causing a system crash and a...

CVE-2026-68238

A flaw was found in the drm/amdgpu component of the Linux kernel. The amdgpuacpivfctbios function fails to release a reference to the VFCT ACPI table after fetching it. This oversight leads to a resource leak, where memory allocated for the table mapping is not properly freed, potentially impacti...

CVE-2026-68103

A flaw was found in the drm/amdgpu component of the Linux kernel. A local attacker could exploit a vulnerability where creating a user-queue with specific parameters overwrites an existing doorbell mapping. This could lead to misrouting of interrupt requests IRQs and incorrect cleanup processes,...

CVE-2026-68245

A flaw was found in the drm/amdgpu component of the Linux kernel. A use-after-unlock vulnerability exists where a virtual machine VM pointer is dereferenced after its protective lock has been released. This allows the pointer to be modified, potentially leading to memory corruption. An attacker...

CVE-2026-68273

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix context pstate override handling There are several problems in the context pstate handling code. The most serious ones are potential use-after-free and NULL pointer dereferences at context initialization time. Bot...

CVE-2026-68106

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix division by zero with invalid uvd dimensions When width or height is less than 16, widthinmb or heightinmb becomes 0, leading to fsinmb being 0. This causes a division by zero when calculating numdpbbuffer in H264...

CVE-2026-68111

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/gfx9: replace BUGON with WARNON There's no need to crash the kernel for these cases. cherry picked from commit b71604f8685b0eba07866f4e8dc30f93e1931054...

CVE-2026-68110

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/sdma4.4.2: replace BUGON with WARNON There's no need to crash the kernel for these cases. cherry picked from commit fa4f86a148271e325e95287630a3a15a9cd35fdc...

CVE-2026-68252

The CVE affects the Linux kernel’s DRM AMDGPU SDMA7.0 code path, where the vulnerable usage was a BUG_ON() that could crash the kernel. It has been fixed by replacing BUG_ON() with WARN_ON(), indicating that such checks should warn rather than crash. Affected component: drm/amdgpu/sdma7.0. Root c...

CVE-2026-68113 drm/amdgpu/gfx12: replace BUG_ON() with WARN_ON()

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/gfx12: replace BUGON with WARNON There's no need to crash the kernel for these cases. cherry picked from commit f952076f76d62f783e8ba4995a7c400d39354ccf...

CVE-2026-68113

CVE-2026-68113: In the Linux kernel (drm/amdgpu/gfx12), the bug has been resolved by replacing BUG_ON() with WARN_ON() to avoid kernel crashes in these cases. The fix prevents an intentional crash when a condition is met, by issuing a warning instead of triggering a crash. The cherry-picked commi...

CVE-2026-68112

The CVE-2026-68112 entry concerns the Linux kernel driver path drm/amdgpu/gfx9.4.3 where a BUG_ON() assertion was replaced with WARN_ON(), indicating the code no longer crashes the kernel for those checks. This is a corrective patch aimed at preventing kernel panics by converting a hard failure i...

CVE-2026-68111 drm/amdgpu/gfx9: replace BUG_ON() with WARN_ON()

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/gfx9: replace BUGON with WARNON There's no need to crash the kernel for these cases. cherry picked from commit b71604f8685b0eba07866f4e8dc30f93e1931054...

CVE-2026-68110

The CVE-2026-68110 entry concerns the Linux kernel component drm/amdgpu/sdma4.4.2. The root cause involved using BUG_ON() in code paths where a crash was previously deemed unnecessary; the fix replaces BUG_ON() with WARN_ON(), so kernel crashes are avoided for these cases. The information indicat...