CVE-2026-97519

The Linux kernel contains a null pointer dereference vulnerability within the drm/xe component during devcoredump cleanup . Specifically, in xe_devcoredump_snapshot_free(), the ss->gt pointer may be NULL if a snapshot was never fully populated, leading to a crash when xe_guc_capture_put_matche...

EUVD-2026-86117

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix null pointer dereference in devcoredump cleanup In xedevcoredumpsnapshotfree, ss-gt may be NULL when the snapshot was never fully populated e.g., when cleanup is triggered without a prior capture. Guard the...

EUVD-2026-86096

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/userq: pin mqd and fw object bo to avoid eviction mqd and fw objects are queue core objects which should remain valid and never be unmapped and evicted for user queues to work properly. During eviction if these buffers...

CVE-2026-97497

The Linux kernel contains a vulnerability in the drm/amdkfd component. The allocate_sdma_queue function fails to perform bounds-checking on the sdma queue id value, which is used by CRIU . This could allow an out-of-bounds access if the specified ID exceeds the maximum number of queues. Remediati...

EUVD-2026-86095

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Check bounds for allocatesdmaqueue restoresdmaid allocatesdmaqueue has an option where the sdma queue id can be specified used by CRIU. We weren't bounds-checking that value. Confirm it's less than the maximum number ...

CVE-2026-97496

The Linux kernel contains an Out-of-Bounds (OOB) memory exposure vulnerability in the drm/amdkfd driver within the get_wave_state() function. The issue stems from the function trusting cp_hqd_cntl_stack_size and cp_hqd_cntl_stack_offset values read from the MQD , which are attacker-controlled via...

EUVD-2026-86094

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix OOB memory exposure in getwavestate The getwavestate function for v9 trusts cphqdcntlstacksize and cphqdcntlstackoffset values read directly from the MQD, which are written by GPU microcode and fully...

EUVD-2026-86093

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Check bounds on allocatedoorbell allocateddoorbell has an option to set the doorbell id to a specific value used by CRIU. This value was not bounds checked. Check to confirm it's less than KFDMAXNUMOFQUEUESPERPROCESS...

CVE-2026-97495

The Linux kernel contains a vulnerability in the drm/amdkfd component where the allocated_doorbell option, used by CRIU to set a specific doorbell id, lacks proper bounds checking. The issue is addressed by confirming that the value is less than KFD_MAX_NUM_OF_QUEUES_PER_PROCESS . While the root ...

EUVD-2026-86091

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Bound GPIO I2C table entry count from VBIOS Reject undersized tables and cap the derived entry count to AMDGPUMAXI2CBUS so we do not overrun adev-i2cbus or walk an absurd number of entries on corrupt size fields...

CVE-2026-97494

The Linux kernel contains a vulnerability in the drm/amdgpu driver related to the psp_copy_fw function. The issue stems from a lack of validation when handling PSP fw_pri_buf copies, where the function previously failed to properly check for errors during drm_dev_enter or validate image sizes. To...

CVE-2026-97493

The Linux kernel contains a vulnerability in the drm/amdgpu driver where the bound GPIO I2C table entry count is sourced from the VBIOS . This can lead to a buffer overrun of adev->i2c_bus[] if the table is undersized or the count is excessively large due to corrupt size fields. The fix involv...

EUVD-2026-86092

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: validate and share PSP fwpribuf copies via pspcopyfw Change pspcopyfw from void to int: return -ENODEV when drmdeventer fails, and -EINVAL when the image size is zero or larger than the 1 MiB PSP private buffer. Repla...

CVE-2026-97431

The Linux kernel contains a vulnerability in the drm/amd/display component. The issue arises because calling dc_update_planes_and_stream separately for a stream and its phantom stream leads to a NULL pointer dereference , as the phantom is destroyed during the first call. The fix involves skippin...

EUVD-2026-86044

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Avoid DPMS-on for phantom stream Why & How Calling dcupdateplanesandstream separately for stream and its phantom stream causes a NULL pointer dereference, since the phantom is destroyed on the first call. Skip th...

CVE-2026-97429

The Linux kernel contains a Use-After-Free (UAF) race condition within the drm/amdkfd component. The vulnerability occurs because the wait_on_destroy_queue() function drops locks while waiting for a queue resume, which allows a concurrent destroy operation to free the queue prematurely. The fix i...

EUVD-2026-86042

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix UAF race in destroyqueuecpsch waitondestroyqueue drops locks to wait for queue resume, allowing a concurrent destroy to free the queue. Use isbeingdestroyed flag to serialize destruction...

EUVD-2026-86041

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: harden FRU PIA parsing with bounded helpers Replace the open-coded TLV walk with frupiaadvance and frupiacopyfield helpers that bound every read by the actual EEPROM data length, preventing out-of-bounds reads on...

CVE-2026-97428

The Linux kernel (specifically the drm/amdgpu driver) is vulnerable to out-of-bounds reads when parsing FRU (Firmware Resource Unit) PIA data. The root cause is an open-coded TLV walk that fails to validate data boundaries against the actual EEPROM data length. To remediate this, the vulnerabilit...

EUVD-2026-86040

In the Linux kernel, the following vulnerability has been resolved: drm/amd/pm: bound ppdpmsetpptable memcpy The powerplay path allocates hardcodepptable once with kmemdup..., softpptablesize. memcpy..., size used the sysfs store count up to PAGESIZE with no upper bound, causing heap overflow...