DEBIAN-CVE-2026-89809

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix scope of mqdmgr dereference in pqmdebugfsmqds Reading /sys/kernel/debug/kfd/mqds while a process holds an active KFD queue triggers a NULL pointer dereference because the for loop that calls mqdmgr-debugfsshowmqd ...

CVE-2026-89808

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix the case that vm range is hole at svmmigratecopytovram When migration vm range is hole at cpu sideMIGRATEPFNMIGRATE set + MIGRATEPFNVALID unset driver still allocates device pages. There is no dma map of src pages...

CVE-2026-89810

CVE-2026-89810 affects the Linux kernel in the drm/amdkfd subsystem (AMD KFD driver). The root cause lies in the svm_migrate_copy_to_ram error path: when page migration from device to system RAM fails, the driver incorrectly used the DMA address (for adev) instead of the page PFN to release and u...

EUVD-2026-80409

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix scope of mqdmgr dereference in pqmdebugfsmqds Reading /sys/kernel/debug/kfd/mqds while a process holds an active KFD queue triggers a NULL pointer dereference because the for loop that calls mqdmgr-debugfsshowmqd ...

CVE-2026-89809 drm/amdkfd: fix scope of mqd_mgr dereference in pqm_debugfs_mqds

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix scope of mqdmgr dereference in pqmdebugfsmqds Reading /sys/kernel/debug/kfd/mqds while a process holds an active KFD queue triggers a NULL pointer dereference because the for loop that calls mqdmgr-debugfsshowmqd ...

EUVD-2026-80408

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix the case that vm range is hole at svmmigratecopytovram When migration vm range is hole at cpu sideMIGRATEPFNMIGRATE set + MIGRATEPFNVALID unset driver still allocates device pages. There is no dma map of src pages...

CVE-2026-89808 drm/amdkfd: Fix the case that vm range is hole at svm_migrate_copy_to_vram

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix the case that vm range is hole at svmmigratecopytovram When migration vm range is hole at cpu sideMIGRATEPFNMIGRATE set + MIGRATEPFNVALID unset driver still allocates device pages. There is no dma map of src pages...

CVE-2026-89807

A NULL pointer dereference in the Linux kernel's drm/amdkfd driver allows a local user holding CAP_CHECKPOINT_RESTORE to panic the machine. Both create_queue_cpsch() and create_queue_nocpsch() call mqd_mgr->restore_mqd() unconditionally during CRIU restore, with no NULL guard. When restore_mqd...

EUVD-2026-71500

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Validate CRIU-restored IDs before idralloc The KFD CRIU restore flow restores previously saved object IDs from userspace. For event restore: kfdcriurestoreevent - createsignalevent / createotherevent -...

CVE-2026-80870 drm/amdkfd: Validate CRIU-restored IDs before idr_alloc

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Validate CRIU-restored IDs before idralloc The KFD CRIU restore flow restores previously saved object IDs from userspace. For event restore: kfdcriurestoreevent - createsignalevent / createotherevent -...

Linux Distros Unpatched Vulnerability : CVE-2026-80747

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/amdkfd: Add bounds check for CRAT subtype length The CRAT parser validates that the subtype header fits within the image, but does not verify that the...

CVE-2026-80747

CVE-2026-80747 is a Linux kernel vulnerability in the drm/amdkfd driver's CRAT table parser . The root cause is a missing bounds check: the parser verifies that the subtype header fits within the image but does not validate that the advertised subtype length stays within bounds. A malformed CRAT ...

EUVD-2026-70351

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Add bounds check for CRAT subtype length The CRAT parser validates that the subtype header fits within the image, but does not verify that the advertised subtype length fits. A malformed CRAT table with an oversized...

CVE-2026-80703

A flaw was found in the Linux kernel's drm/amdkfd component. A local user with access to /dev/kfd could exploit a missing authorization check to terminate another process's active Graphics Processing Unit GPU debug session. This could lead to a denial of service for other users attempting to debu...

CVE-2026-80618

A flaw was found in the kernel's AMD GPU driver drm/amdkfd. This vulnerability occurs when the driver attempts to unpin a memory buffer object BO twice during memory deallocation. A local attacker could exploit this double-unpin operation, leading to a memory management error. This issue can caus...

Linux Distros Unpatched Vulnerability : CVE-2026-80618

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/amdkfd: Avoid double-unpin of DOORBELL/MMIO BOs on free amdgpuamdkfdgpuvmfreememoryofgpu unpinned DOORBELL and MMIO remap BOs which are pinned at allocation...

CVE-2026-80703

CVE-2026-80703 affects the Linux kernel 's drm/amdkfd component. The ioctl KFD_IOC_DBG_TRAP_DISABLE lacked an authorization check, allowing any user with access to /dev/kfd to terminate another process's active GPU debug session without verifying ownership or ptrace permissions. The fix introduce...

CVE-2026-80703 drm/amdkfd: Fix missing authorization check in KFD_IOC_DBG_TRAP_DISABLE

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix missing authorization check in KFDIOCDBGTRAPDISABLE Prevent unauthorized termination of active GPU debug sessions. Previously, users with /dev/kfd access could terminate another process's debug session without...

CVE-2026-80618 drm/amdkfd: Avoid double-unpin of DOORBELL/MMIO BOs on free

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Avoid double-unpin of DOORBELL/MMIO BOs on free amdgpuamdkfdgpuvmfreememoryofgpu unpinned DOORBELL and MMIO remap BOs which are pinned at allocation time before checking whether the BO is still mapped to the GPU. When...

CVE-2026-80618 drm/amdkfd: Avoid double-unpin of DOORBELL/MMIO BOs on free

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Avoid double-unpin of DOORBELL/MMIO BOs on free amdgpuamdkfdgpuvmfreememoryofgpu unpinned DOORBELL and MMIO remap BOs which are pinned at allocation time before checking whether the BO is still mapped to the GPU. When...