RLSA-2026:57252 Important: kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: netfilter: nfconntrackh323: fix OOB read in decodechoice CVE-2026-43233 kernel: drm/amdkfd: Fix out-of-bounds write in kfdeventpageset CVE-2026-43206 kernel: drm/amdgpu: Refactor...

CVE-2026-74422

In the Linux kernel, the following vulnerability has been resolved: drm/rockchip: inno-hdmi: Switch to drmmkzalloc Driver makes use of drmmencoderinit to initialize the encoder and automatically handle the cleanup by registering drmencodercleanup with drmmaddaction. However, the internal structur...

CVE-2026-74422

In CVE-2026-74422, the Linux kernel’s drm/rockchip inno-hdmi encoder uses a device-managed allocation (devm_kzalloc) for its internal structure during component_bind_all. When the DRM device reference is dropped (drm_dev_put) and drmm_encoder_alloc_release runs, the encoder structure may have bee...

CVE-2026-74417

CVE-2026-74417 affects the Linux kernel DRM/Radeon path, specifically the radeon_align_pitch() routine. The issue is an integer overflow in the alignment round-up and the final pitch calculation that can yield an invalid pitch or a zero-sized dumb buffer in radeon_mode_dumb_create(). The fix intr...

CVE-2026-72313

CVE-2026-72313 concerns the Linux kernel DRM fb-helper: the fix ensures fbdev output is synchronized only to the vblank of an active CRTC. The change iterates the CRTC list and selects the first active CRTC for vblank synchronization, instead of assuming a fixed CRTC. This addresses a warning and...

CVE-2026-72313 drm/fb-helper: Only consider active CRTCs for vblank sync

In the Linux kernel, the following vulnerability has been resolved: drm/fb-helper: Only consider active CRTCs for vblank sync Only synchronize fbdev output to the vblank of an active CRTC. Go over the list of CRTCs and pick the first that matches. Fixes warnings as the one shown below 77.201354...

PT-2026-72829

In the Linux kernel, the following vulnerability has been resolved: drm/syncobj: Fix memory leak in drm syncobj find fence Commit 18226ba52159 "drm/syncobj: reject invalid flags in drm syncobj find fence" forgot to take into account the fact that drm syncobj find takes a reference to syncobj and...

Linux Distros Unpatched Vulnerability : CVE-2026-74444

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/vmwgfx: validate DRAWPRIMITIVES header size before division vmwcmddraw computes maxnum = header-size - sizeofcmd-body / sizeofdecl %NASLMINLEVEL 80900 C...

The vulnerability in the component drm/panel/panel-simple.c of the Linux operating system allows a hacker to trigger a service failure.

The vulnerability in the drm/panel/panel-simple.c component of the Linux operating system is related to improper memory release before deleting the last reference. Exploiting this vulnerability could allow an attacker to cause a service failure...

DEBIAN-CVE-2026-68430

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/gfx8: drop unecessary BUGON There's no need to crash the kernel for this case. cherry picked from commit 4d7c25208ca612b754f3bf39e9f16e725b828891...

CVE-2026-68430

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/gfx8: drop unecessary BUGON There's no need to crash the kernel for this case. cherry picked from commit 4d7c25208ca612b754f3bf39e9f16e725b828891...

CVE-2026-68430 drm/amdgpu/gfx8: drop unecessary BUG_ON()

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/gfx8: drop unecessary BUGON There's no need to crash the kernel for this case. cherry picked from commit 4d7c25208ca612b754f3bf39e9f16e725b828891...

CVE-2026-68115

A flaw was found in the Linux kernel's drm/amdgpu/gfx10 component. Under certain unexpected conditions, the kernel could crash, leading to a system-wide Denial of Service DoS. This issue has been resolved by preventing the kernel from crashing in these scenarios...

CVE-2026-68305

A flaw was found in the Linux kernel's Direct Rendering Manager DRM subsystem. This vulnerability arises when graphics buffer objects are deallocated prematurely while the DRM structure remains active. This can lead to a null pointer dereference when the system attempts to access these freed...

CVE-2026-68262

In the Linux kernel, the following vulnerability has been resolved: drm/imagination: Fix user array stride in pvrsetuobjarray pvrsetuobjarray copies an array of kernel objects to a userspace array whose element size is described by out-stride. When out-stride is different from the kernel object...

DEBIAN-CVE-2026-68113

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/gfx12: replace BUGON with WARNON There's no need to crash the kernel for these cases. cherry picked from commit f952076f76d62f783e8ba4995a7c400d39354ccf...

CVE-2026-68101

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

UBUNTU-CVE-2026-68112

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/gfx9.4.3: replace BUGON with WARNON There's no need to crash the kernel for these cases. cherry picked from commit 5676593d08998d7a6d9e2d51d6b54b3820e3755c...

CVE-2026-68270 drm/sysfb: Avoid possible truncation with calculating visible size

In the Linux kernel, the following vulnerability has been resolved: drm/sysfb: Avoid possible truncation with calculating visible size Calculating the visible size of the system framebuffer can result in truncation of the result. The calculation uses 32-bit arithmetics, which can overflow if the...

CVE-2026-68264 drm/xe/pt: Reset current_op in xe_pt_update_ops_init()

In the Linux kernel, the following vulnerability has been resolved: drm/xe/pt: Reset currentop in xeptupdateopsinit xeptupdateopsinit fails to reset currentop to 0. On the vmbind path, opsexecute calls xeptupdateopsprepare inside the xevalidationguard / drmexecuntilalllocked loop. When that loop...