CVE-2026-100077

A flaw was found in the Linux kernel's MSM DRM driver. This vulnerability can lead to a Denial of Service DoS during GPU recovery operations. If a hung command submission is retired before the hardware recovery process completes, the driver may release memory buffers that the GPU is still activel...

ROS-20260916-73-0087

The vulnerability of the atmelhlcdcplaneatomicduplicatestate function in the drivers/gpu/drm/atmel-hlcdc/atmelhlcdcplane.c driver of the Direct Rendering Infrastructure DRI infrastructure of the Linux operating system is related to the reutilization of previously freed memory. Exploiting this...

Astra Linux – Vulnerability in Linux 5.10, Linux, Linux 5.15

A issue was discovered in the Linux kernel through version 6.1-rc8. The function dpucrtcatomiccheck in the file drivers/gpu/drm/msm/disp/dpu1/dpucrtc.c lacks a check for the return value of kzalloc. This issue may lead to a NULL Pointer Dereference...

EUVD-2026-77142

An issue was discovered in DPU in Samsung Mobile Processor Exynos 1280, 2200, 1380, 1480, 2400, 1580, 2500, 1680, and 2600. A TOCTOU race condition in the Exynos DRM HDR Driver leads to a heap overflow, causing a kernel crash...

CVE-2026-80919 drm/amdgpu: fix recursive ww_mutex acquire in amdgpu_devcoredump_format

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix recursive wwmutex acquire in amdgpudevcoredumpformat When dumping IB contents from a hung job, amdgpudevcoredumpformat acquired the VM root PD's reservation via amdgpuvmlockbypasid and then, for each IB, called...

CVE-2026-80887

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: use checkaddoverflow for shader size+offset bound vmwshaderdefine validates the user-supplied shader window against its backing buffer with u64buffer-tbo.base.size guestmemoryoffset and forwarded to host SVGA...

AZL-99603 CVE-2026-80887 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: use checkaddoverflow for shader size+offset bound vmwshaderdefine validates the user-supplied shader window against its backing buffer with u64buffer-tbo.base.size guestmemoryoffset and forwarded to host SVGA...

CVE-2026-80909

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Reject UVD message with invalid number of h265 refs Same change as for h264, avoids overflow later when calculating min dpb size. cherry picked from commit a4b0720e4f1601f97f59a2be9c1b4b94fa6527d5...

CVE-2026-80908

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Reject UVD message with dimensions above 4096 Fixes potential overflow in DPB size calculations. cherry picked from commit 05e1387d151f71569fbe122d2c89f9db0c21dc10...

CVE-2026-80888

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: drop dmabuf reference on foreign-fd prime import ttmprimefdtohandle returns -ENOSYS when the imported fd's dmabuf-ops do not match the ttmobjectdevice's ops, but does so without releasing the reference acquired by...

CVE-2026-80728

This Linux kernel vulnerability affects the DRM/amdgpu driver. The root cause is a devres teardown ordering issue : because devres teardown is LIFO and the aperture devres node was registered after the DRM device node, devres_release_all() unmaps the aperture before the DRM device release callbac...

Linux Distros Unpatched Vulnerability : CVE-2026-80702

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/vmwgfx: fix guestmemorydirty bitfield clobbered as size Two sites in vmwgfxresource.c assign boolean literals to res-guestmemorysize, which is an unsigned...

SUSE CVE-2026-74638

In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Serialize the scheduler timeout handlers V3D exposes several independent hardware queues BIN, RENDER, TFU and CSD but has only a single, global reset. A timeout on any one queue therefore has to stop, reset and restart t...

UBUNTU-CVE-2026-80704

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: use proper context for logging The same as the rest of the code, getssinfofromatombios uses calcpllcs-ctx-logger for logging. But calcpllcs-ctx is initialized only later in calcpllmaxvcoconstruct. Therefore, any...

CVE-2026-80702

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: fix guestmemorydirty bitfield clobbered as size Two sites in vmwgfxresource.c assign boolean literals to res-guestmemorysize, which is an unsigned long allocation-size field; the intended target is the adjacent...

CVE-2026-80701

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: enforce cursor size limits for MOB cursors vmwcursorplaneatomiccheck bounds cursor width and height only on the legacy update path; the SVGACAP2CURSORMOB path -- the default on modern hosts -- accepts any size. When t...

CVE-2026-80700

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: validate external BO copy bounds for both stride paths vmwexternalbocopy trusts caller-supplied offsets, strides, and heights and operates on imported dma-buf vmaps: - The equal-stride memcpy bound was clamped after...

PT-2026-82958

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A null pointer dereference can occur in the dw dp remove function within the Rockchip DRM driver. This happens when the platform driver's remove callback attempts to access driver data v...

SUSE CVE-2026-80539

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: disallow multiple FENCE chunks in one submit amdgpucspass1 dispatches on chunkid once per chunk without rejecting repeated ids. p-ufbo is a single-slot field, so a submission carrying two AMDGPUCHUNKIDFENCE chunks run...

CVE-2026-80541

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: validate GEMCREATE domain combinations AMDGPUGEMCREATE checked domain bits against AMDGPUGEMDOMAINMASK, but did not validate domain combinations. Userspace could combine CPU|GTT|VRAM with DOORBELL, GDS, GWS, or OA,...