CVE-2026-97494 drm/amdgpu: validate and share PSP fw_pri_buf copies via psp_copy_fw

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: validate and share PSP fwpribuf copies via pspcopyfw Change pspcopyfw from void to int: return -ENODEV when drmdeventer fails, and -EINVAL when the image size is zero or larger than the 1 MiB PSP private buffer. Repla...

CVE-2026-97428 drm/amdgpu: harden FRU PIA parsing with bounded helpers

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: harden FRU PIA parsing with bounded helpers Replace the open-coded TLV walk with frupiaadvance and frupiacopyfield helpers that bound every read by the actual EEPROM data length, preventing out-of-bounds reads on...

EUVD-2026-86041

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: harden FRU PIA parsing with bounded helpers Replace the open-coded TLV walk with frupiaadvance and frupiacopyfield helpers that bound every read by the actual EEPROM data length, preventing out-of-bounds reads on...

CVE-2026-97428 drm/amdgpu: harden FRU PIA parsing with bounded helpers

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: harden FRU PIA parsing with bounded helpers Replace the open-coded TLV walk with frupiaadvance and frupiacopyfield helpers that bound every read by the actual EEPROM data length, preventing out-of-bounds reads on...

CVE-2026-97428

The Linux kernel contains a vulnerability within the drm/amdgpu component related to FRU PIA parsing . The root cause is an open-coded TLV walk that fails to properly bound reads against the actual EEPROM data length , potentially leading to out-of-bounds reads when processing truncated or malfor...

CVE-2026-97426 drm/amdgpu/pm: fix SmartShift bias sysfs store PM refcount on parse error

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/pm: fix SmartShift bias sysfs store PM refcount on parse error Return the parse error before acquiring PM access...

CVE-2026-97426

The Linux kernel contains a vulnerability in the drm/amdgpu/pm component related to the SmartShift bias sysfs store . The root cause is that the system returns a parse error before acquiring the PM refcount , which can lead to issues during error handling. A fix has been implemented to ensure the...

CVE-2026-97426 drm/amdgpu/pm: fix SmartShift bias sysfs store PM refcount on parse error

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/pm: fix SmartShift bias sysfs store PM refcount on parse error Return the parse error before acquiring PM access...

CVE-2026-97425 drm/amdgpu: fix buffer overflow during vBIOS update

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix buffer overflow during vBIOS update Clamp the buffer postion to write by setting the bin attribute to the maximum buffer size so that VFS layer will block the out-of-bounds accessing...

CVE-2026-97425

A buffer overflow vulnerability exists in the Linux kernel within the drm/amdgpu component during a vBIOS update . The root cause is an improper handling of buffer positions, which could allow out-of-bounds access. The issue is resolved by clamping the buffer position to the maximum buffer size u...

EUVD-2026-86038

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix buffer overflow during vBIOS update Clamp the buffer postion to write by setting the bin attribute to the maximum buffer size so that VFS layer will block the out-of-bounds accessing...

CVE-2026-97425 drm/amdgpu: fix buffer overflow during vBIOS update

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix buffer overflow during vBIOS update Clamp the buffer postion to write by setting the bin attribute to the maximum buffer size so that VFS layer will block the out-of-bounds accessing...

CVE-2026-97424 drm/amdgpu/ras: add ras_suspend callback and use it for cp_ecc_error_irq

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/ras: add rassuspend callback and use it for cpeccerrorirq cpeccerrorirq is acquired in amdgpugfxraslateinit but released in gfxv90hwfini, so the put site has to query amdgpuirqenabled because the get is skipped on SR-I...

CVE-2026-97424

The Linux kernel contains a vulnerability in the drm/amdgpu/ras component related to the cp_ecc_error_irq interrupt. Specifically, the interrupt was acquired in amdgpu_gfx_ras_late_init() but released in gfx_v9_0_hw_fini(), creating a mismatch because the acquisition was skipped on SR-IOV VF . To...

CVE-2026-97424 drm/amdgpu/ras: add ras_suspend callback and use it for cp_ecc_error_irq

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/ras: add rassuspend callback and use it for cpeccerrorirq cpeccerrorirq is acquired in amdgpugfxraslateinit but released in gfxv90hwfini, so the put site has to query amdgpuirqenabled because the get is skipped on SR-I...

CVE-2026-93809 drm/amdgpu: flush pending RCU callbacks on module unload

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: flush pending RCU callbacks on module unload Call rcubarrier in module exit to wait for outstanding callrcu callbacks before freeing module text, preventing late callback execution in freed memory. BUG: unable to hand...

CVE-2026-93809 drm/amdgpu: flush pending RCU callbacks on module unload

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: flush pending RCU callbacks on module unload Call rcubarrier in module exit to wait for outstanding callrcu callbacks before freeing module text, preventing late callback execution in freed memory. BUG: unable to hand...

CVE-2026-93809

The Linux kernel 's drm/amdgpu component is affected by a vulnerability where the module failed to properly handle RCU callbacks during a module unload. This issue caused the system to attempt to execute late callbacks in freed memory, leading to a page fault and a potential kernel crash. The fix...

EUVD-2026-86196

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: flush pending RCU callbacks on module unload Call rcubarrier in module exit to wait for outstanding callrcu callbacks before freeing module text, preventing late callback execution in freed memory. BUG: unable to hand...

PT-2026-98059

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A buffer overflow occurs during a vBIOS update in the drm/amdgpu component. The issue is addressed by clamping the buffer position to write by setting the bin attribute to the maximum...