The vulnerability of DRM/V3D components in Linux operating systems allows a perpetrator to trigger a service failure.

The vulnerability of DRM/V3D components in the Linux operating system is related to incorrect calculation of buffer sizes. Exploiting this vulnerability can allow a hacker to cause service interruptions...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-099957)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099957 advisory. In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Clamp HDMI HDCP2 rxidlist read to buffer size Why & How During HDCP 2.x repeater...

SUSE CVE-2026-74444

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: validate DRAWPRIMITIVES header size before division vmwcmddraw computes maxnum = header-size - sizeofcmd-body / sizeofdecl; where header-size is u32 and is taken straight from the user-supplied command stream. When...

SUSE CVE-2026-74449

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix divide-by-zero in calculatemcachesetting on zero viewport If a plane reaches calculatemcachesetting with a zero-area viewport, calculatemcachesetting exits early with nummcaches == 0 and mvmpgwidth/height == ...

AZL-96162 CVE-2026-74454 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO size vc4overflowmemwork points BPOA at a 512KB slot inside the 16MB binner BO, but writes the size of the whole BO to BPOS. On every binner out-of-memory event...

AZL-95991 CVE-2026-74453 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Zero the tile state data array before each BIN job The binner BO is a single 16MB buffer split into 512KB slots that are handed out to jobs at submission time and recycled as jobs complete, without ever being cleared. Ea...

CVE-2026-74448

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix QID bit leak in pqmcreatequeue When MES is enabled and amdgpuamdkfdallockernelmem fails during the first queue creation for a process, pqmcreatequeue returns early via 'return retval' without going through the...

CVE-2026-74452

In the Linux kernel, the following vulnerability has been resolved: drm/panthor: reject firmware sections with oversized data In panthorfwloadsectionentry, the data size to copy is calculated without validating it against the allocated sectionsize: section-data.size = hdr.data.end - hdr.data.star...

AZL-96249 CVE-2026-74450 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: drm/amd/pm: fix pptable use-after-free amdgpudpmgetpptable returns a pointer to a driver-owned power table after dropping adev-pm.mutex. The sysfs path then copies from that pointer. A concurrent pptable write can replace and fre...

AZL-96234 CVE-2026-74444 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: validate DRAWPRIMITIVES header size before division vmwcmddraw computes maxnum = header-size - sizeofcmd-body / sizeofdecl; where header-size is u32 and is taken straight from the user-supplied command stream. When...

UBUNTU-CVE-2026-74440

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Wait on external BO kernel fences in exec IOCTL Before arming a user job, xeexecioctl only added the VM's dma-resv KERNEL slot as a dependency. That slot covers rebinds and the kernel operations of the VM's private BOs, b...

CVE-2026-74440

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Wait on external BO kernel fences in exec IOCTL Before arming a user job, xeexecioctl only added the VM's dma-resv KERNEL slot as a dependency. That slot covers rebinds and the kernel operations of the VM's private BOs, b...

CVE-2026-74446

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: hold eventmutex while checkpointing CRIU events kfdcriucheckpointevents counts the entries in p-eventidr via kfdgetnumevents, allocates an array sized to that count, and then walks the same IDR to fill it. Neither the...

UBUNTU-CVE-2026-74454

In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO size vc4overflowmemwork points BPOA at a 512KB slot inside the 16MB binner BO, but writes the size of the whole BO to BPOS. On every binner out-of-memory event...

UBUNTU-CVE-2026-74453

In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Zero the tile state data array before each BIN job The binner BO is a single 16MB buffer split into 512KB slots that are handed out to jobs at submission time and recycled as jobs complete, without ever being cleared. Ea...

UBUNTU-CVE-2026-74450

In the Linux kernel, the following vulnerability has been resolved: drm/amd/pm: fix pptable use-after-free amdgpudpmgetpptable returns a pointer to a driver-owned power table after dropping adev-pm.mutex. The sysfs path then copies from that pointer. A concurrent pptable write can replace and fre...

UBUNTU-CVE-2026-74443

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: bound DMA command body size against suffix pointer vmwcmddma locates the DMA suffix at unsigned long &cmd-body + header-size - sizeofsuffix without checking that header-size is large enough to contain both cmd-body an...

CVE-2026-74452 drm/panthor: reject firmware sections with oversized data

In the Linux kernel, the following vulnerability has been resolved: drm/panthor: reject firmware sections with oversized data In panthorfwloadsectionentry, the data size to copy is calculated without validating it against the allocated sectionsize: section-data.size = hdr.data.end - hdr.data.star...

CVE-2026-74452

The CVE-2026-74452 issue affects the Linux kernel DRM Panthor firmware loading. In panthor_fw_load_section_entry(), the copied data size is computed as hdr.data.end - hdr.data.start without validating against the allocated section_size, permitting a crafted firmware to set section->data.size l...

CVE-2026-74453

In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Zero the tile state data array before each BIN job The binner BO is a single 16MB buffer split into 512KB slots that are handed out to jobs at submission time and recycled as jobs complete, without ever being cleared. Ea...