200 matches found
CVE-2026-99214
In the Linux kernel, the following vulnerability has been resolved: d...
CVE-2026-99214
In the Linux kernel, the following vulnerability has been resolved: drm/vc4: hdmi: Move packet RAM enable to PM runtime Audio can be triggered by the HPD handler and start up before video has been restored, calling vc4hdmiwriteinfoframe for the audio infoframe. vc4hdmiwriteinfoframe needs Packet...
EUVD-2026-111966
In the Linux kernel, the following vulnerability has been resolved: drm/vc4: hdmi: Move packet RAM enable to PM runtime Audio can be triggered by the HPD handler and start up before video has been restored, calling vc4hdmiwriteinfoframe for the audio infoframe. vc4hdmiwriteinfoframe needs Packet...
CVE-2026-99214
The Linux kernel contains a vulnerability in the drm/vc4 driver related to HDMI output. A race condition exists where audio can be triggered by the HPD handler and begin startup before video is fully restored. This leads to a call to vc4_hdmi_write_infoframe() while Packet RAM is disabled, as the...
CVE-2026-99214 drm/vc4: hdmi: Move packet RAM enable to PM runtime
In the Linux kernel, the following vulnerability has been resolved: drm/vc4: hdmi: Move packet RAM enable to PM runtime Audio can be triggered by the HPD handler and start up before video has been restored, calling vc4hdmiwriteinfoframe for the audio infoframe. vc4hdmiwriteinfoframe needs Packet...
PT-2026-128207
In the Linux kernel, the following vulnerability has been resolved: drm/vc4: hdmi: Move packet RAM enable to PM runtime Audio can be triggered by the HPD handler and start up before video has been restored, calling vc4 hdmi write infoframe for the audio infoframe. vc4 hdmi write infoframe needs...
UBUNTU-CVE-2026-99214
In the Linux kernel, the following vulnerability has been resolved: drm/vc4: hdmi: Move packet RAM enable to PM runtime Audio can be triggered by the HPD handler and start up before video has been restored, calling vc4hdmiwriteinfoframe for the audio infoframe. vc4hdmiwriteinfoframe needs Packet...
SUSE CVE-2026-98946
In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Disable the V3D interrupt across runtime suspend vc4irqdisable masks the V3D interrupt sources and then calls synchronizeirq before the V3D is powered down. However, by itself, this is not enough to quiesce the interrupt...
AZL-111128 CVE-2026-99095 affecting package kernel 6.6.157.1-1
In the Linux kernel, the following vulnerability has been resolved: drm/vc4: drain the hangcheck timer and works on V3D unbind Nothing stops the hangcheck timer that submitted jobs arm, or the jobdonework that the render-done interrupt queues, at teardown: vc4irqdisable cancels only...
DEBIAN-CVE-2026-99095
In the Linux kernel, the following vulnerability has been resolved: drm/vc4: drain the hangcheck timer and works on V3D unbind Nothing stops the hangcheck timer that submitted jobs arm, or the jobdonework that the render-done interrupt queues, at teardown: vc4irqdisable cancels only...
CVE-2026-99095
In the Linux kernel, the following vulnerability has been resolved: drm/vc4: drain the hangcheck timer and works on V3D unbind Nothing stops the hangcheck timer that submitted jobs arm, or the jobdonework that the render-done interrupt queues, at teardown: vc4irqdisable cancels only...
UBUNTU-CVE-2026-99095
In the Linux kernel, the following vulnerability has been resolved: drm/vc4: drain the hangcheck timer and works on V3D unbind Nothing stops the hangcheck timer that submitted jobs arm, or the jobdonework that the render-done interrupt queues, at teardown: vc4irqdisable cancels only...
CVE-2026-99095
In the Linux kernel, the following vulnerability has been resolved: drm/vc4: drain the hangcheck timer and works on V3D unbind Nothing stops the hangcheck timer that submitted jobs arm, or the jobdonework that the render-done interrupt queues, at teardown: vc4irqdisable cancels only...
CVE-2026-99095 drm/vc4: drain the hangcheck timer and works on V3D unbind
In the Linux kernel, the following vulnerability has been resolved: drm/vc4: drain the hangcheck timer and works on V3D unbind Nothing stops the hangcheck timer that submitted jobs arm, or the jobdonework that the render-done interrupt queues, at teardown: vc4irqdisable cancels only...
EUVD-2026-109901
In the Linux kernel, the following vulnerability has been resolved: drm/vc4: drain the hangcheck timer and works on V3D unbind Nothing stops the hangcheck timer that submitted jobs arm, or the jobdonework that the render-done interrupt queues, at teardown: vc4irqdisable cancels only...
CVE-2026-99095 drm/vc4: drain the hangcheck timer and works on V3D unbind
In the Linux kernel, the following vulnerability has been resolved: drm/vc4: drain the hangcheck timer and works on V3D unbind Nothing stops the hangcheck timer that submitted jobs arm, or the jobdonework that the render-done interrupt queues, at teardown: vc4irqdisable cancels only...
CVE-2026-99095
The Linux kernel contains a vulnerability in the drm/vc4 driver where the hangcheck timer and job_done_work are not properly stopped during teardown. Specifically, vc4_irq_disable() fails to cancel these tasks, leading to situations where a timer reads V3D registers through a NULL pointer and lat...
PT-2026-123382
In the Linux kernel, the following vulnerability has been resolved: drm/vc4: drain the hangcheck timer and works on V3D unbind Nothing stops the hangcheck timer that submitted jobs arm, or the job done work that the render-done interrupt queues, at teardown: vc4 irq disable cancels only overflow...
Linux Distros Unpatched Vulnerability : CVE-2026-99095
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/vc4: drain the hangcheck timer and works on V3D unbind Nothing stops the hangcheck timer that submitted jobs arm, or the jobdonework that the render-done...
DEBIAN-CVE-2026-98970
In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Free the BO cache size list on teardown vc4bocachedestroy purges the cached BOs but never frees the size list, leaking it on every unbind...