CVE-2026-93139: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/mes: Fix hungqueuedbarray loop limit for multi-XCC The loop iterated only AMDGPUMAXMESPIPES times, leaving entries uninitialized for multi-XCC GPUs. This causes null pointer dereferences when accessing arrays indexed b...

PT-2026-94935

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the drm/amdgpu/mes component where a loop limit for hung queue db array was incorrectly set to only AMDGPU MAX MES PIPES iterations. On multi-XCC X-Complexity Cluster...

PT-2026-94974

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the drm/amdgpu/pm/powerplay component where vddInd and vddcInd fields from VBIOS-parsed tables are used to index into voltage lookup tables without a proper bounds...

DEBIAN-CVE-2026-89818

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vcn: fix integer overflow in decmsg buffer count check If the supplied msg2 numbuffers is 0x3FFFFFFF, the expression 6 + numbuffers 4 wraps to 2 and the bounds check passes, letting the parser loop far past the end of...

AZL-101156 CVE-2026-89818 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vcn: fix integer overflow in decmsg buffer count check If the supplied msg2 numbuffers is 0x3FFFFFFF, the expression 6 + numbuffers 4 wraps to 2 and the bounds check passes, letting the parser loop far past the end of...

AZL-101589 CVE-2026-89814 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: clamp the isolation index for rings outside a partition adev-isolation has one slot per partition, but a ring that is not assigned to one keeps AMDGPUXCPNOPARTITION, which is 0, so indexing the array with it is out of...

CVE-2026-89818 drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vcn: fix integer overflow in decmsg buffer count check If the supplied msg2 numbuffers is 0x3FFFFFFF, the expression 6 + numbuffers 4 wraps to 2 and the bounds check passes, letting the parser loop far past the end of...

CVE-2026-89814 drm/amdgpu: clamp the isolation index for rings outside a partition

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: clamp the isolation index for rings outside a partition adev-isolation has one slot per partition, but a ring that is not assigned to one keeps AMDGPUXCPNOPARTITION, which is 0, so indexing the array with it is out of...

CVE-2026-89813 drm/amdgpu: force complete the KIQ ring fences on reset

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: force complete the KIQ ring fences on reset Like the MES scheduler ring, the KIQ ring sets noscheduler = true and uses a polling fence, so it is skipped by the force-completion loop in amdgpudevicepreasicreset. Its hw...

PT-2026-93454

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the drm/amdgpu component where the KIQ ring is skipped by the force-completion loop in the amdgpu device pre asic reset function because it uses a polling fence and ha...

CVE-2026-89828: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix init ordering in amdgpuvrammgrinit drmmcgroupregisterregion is called before INITLISTHEAD and gpubuddyinit in amdgpuvrammgrinit. If it fails, the function returns early and bypasses those initializations. Since...

CVE-2026-89814: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: clamp the isolation index for rings outside a partition adev-isolation has one slot per partition, but a ring that is not assigned to one keeps AMDGPUXCPNOPARTITION, which is 0, so indexing the array with it is out of...

CVE-2026-89813: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: force complete the KIQ ring fences on reset Like the MES scheduler ring, the KIQ ring sets noscheduler = true and uses a polling fence, so it is skipped by the force-completion loop in amdgpudevicepreasicreset. Its hw...

CVE-2026-89812: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: force complete the MES ring fences on reset The MES scheduler ring has no drm scheduler noscheduler = true, so it is skipped by the force-completion loop in amdgpudevicepreasicreset. It uses a polling fence whose hw...

PT-2026-93453

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the drm/amdgpu component where the MES scheduler ring is skipped by the force-completion loop in the amdgpu device pre asic reset function because it lacks a drm...

PT-2026-93468

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the drm/amdgpu component where the amdgpu uvd resume function unconditionally force-completes the decode ring during the restoration of its fence sequence. This occurs...

CVE-2026-89827: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: avoid force-completing uninitialized UVD rings uvdv70swinit does not initialize the UVD decode ring for an SR-IOV VF. However, amdgpuuvdresume unconditionally force-completes the decode ring when restoring its fence...

PT-2026-93455

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds array indexing issue exists in the drm/amdgpu component. The adev-isolation array contains one slot per partition; however, rings not assigned to a partition retain the...

CVE-2026-89818: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vcn: fix integer overflow in decmsg buffer count check If the supplied msg2 numbuffers is 0x3FFFFFFF, the expression 6 + numbuffers 4 wraps to 2 and the bounds check passes, letting the parser loop far past the end of...

PT-2026-93459

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An integer overflow exists in the drm/amdgpu/vcn component during the dec msg buffer count check. When the num buffers variable is set to 0x3FFFFFFF, the calculation 6 + num buffers 4...