CVE-2026-64008

In the Linux kernel, the following vulnerability has been resolved: accel/rocket: fix UAF via dangling GEM handle in createbo rocketioctlcreatebo inserts a GEM handle into the file's IDR via drmgemhandlecreate early on, then performs several operations that can fail sgt allocation, drmmm insert,...

CVE-2026-63885 drm/gem: fix race between change_handle and handle_delete

In the Linux kernel, the following vulnerability has been resolved: drm/gem: fix race between changehandle and handledelete drmgemchangehandleioctl leaves the old handle live in the IDR during the window between spinunlocktablelock and the final spinlocktablelock. A concurrent drmgemhandledelete ...

EUVD-2026-45770

In the Linux kernel, the following vulnerability has been resolved: drm/gem: fix race between changehandle and handledelete drmgemchangehandleioctl leaves the old handle live in the IDR during the window between spinunlocktablelock and the final spinlocktablelock. A concurrent drmgemhandledelete ...

CVE-2026-63885

In the Linux kernel, the following vulnerability has been resolved: drm/gem: fix race between changehandle and handledelete drmgemchangehandleioctl leaves the old handle live in the IDR during the window between spinunlocktablelock and the final spinlocktablelock. A concurrent drmgemhandledelete ...

CVE-2026-63884

CVE-2026-63884 affects the Linux kernel i915 driver with a UAF risk during TTM object purge. The issue arises when a bo->ttm object is mutated by ttm_bo_validate() and then cast to an i915_tt pointer, leading to a dereference after the object’s placement/caching policy may be changed (eviction...

CVE-2026-63882

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix NULL pointer bug in svmrangesetattr The processinfo could be NULL if user doesn't call kfdioctlacquirevm before calling kfdioctlsvm. cherry picked from commit 83a26c812e0529eb040d31a76f73e33e637243d4...

CVE-2026-63882

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix NULL pointer bug in svmrangesetattr The processinfo could be NULL if user doesn't call kfdioctlacquirevm before calling kfdioctlsvm. cherry picked from commit 83a26c812e0529eb040d31a76f73e33e637243d4...

CVE-2026-63881 drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger getqueueids computes arraysize = numqueues sizeofuint32t, which could overflow on 32-bit sizet build. using arraysize instead, it saturates to SIZEMAX on overflo...

CVE-2026-63881

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger getqueueids computes arraysize = numqueues sizeofuint32t, which could overflow on 32-bit sizet build. using arraysize instead, it saturates to SIZEMAX on overflo...

CVE-2026-63881

CVE-2026-63881 affects the Linux kernel DRM/AMDKFD debugger path. The get_queue_ids() function computed array_size as num_queues * sizeof(uint32_t), which could overflow on 32-bit size_t builds. The fix replaces this with a safe-sized approach using array_size(), causing saturation to SIZE_MAX on...

CVE-2026-63881

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger getqueueids computes arraysize = numqueues sizeofuint32t, which could overflow on 32-bit sizet build. using arraysize instead, it saturates to SIZEMAX on overflo...

CVE-2026-63880 drm/amdgpu: fix lock leak on ENOMEM in AMDGPU_GEM_OP_GET_MAPPING_INFO

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix lock leak on ENOMEM in AMDGPUGEMOPGETMAPPINGINFO The AMDGPUGEMOPGETMAPPINGINFO branch of amdgpugemopioctl holds three cleanup-tracked resources before calling kvcalloc: the drmgemobject reference from...

CVE-2026-63880

CVE-2026-63880 affects the Linux kernel AMDGPU driver (drm/amdgpu) in the AMDGPU_GEM_OP_GET_MAPPING_INFO path. A -ENOMEM failure in kvcalloc could skip cleanup and leak three locks (drm_gem_object reference, drm_exec lock on the GEM, and drm_exec lock on the per-process VM root PD), causing a loa...

CVE-2026-63863 drm/gpusvm: Fix unbalanced unlock in drm_gpusvm_scan_mm()

In the Linux kernel, the following vulnerability has been resolved: drm/gpusvm: Fix unbalanced unlock in drmgpusvmscanmm There is a unbalanced lock/unlock to gpusvm notifier lock: 931.045868 ===================================== 931.046509 WARNING: bad unlock balance detected! 931.047149...

EUVD-2026-45547

In the Linux kernel, the following vulnerability has been resolved: drm/gpusvm: Fix unbalanced unlock in drmgpusvmscanmm There is a unbalanced lock/unlock to gpusvm notifier lock: 931.045868 ===================================== 931.046509 WARNING: bad unlock balance detected! 931.047149...

CVE-2026-63863

In the Linux kernel, the following vulnerability has been resolved: drm/gpusvm: Fix unbalanced unlock in drmgpusvmscanmm There is a unbalanced lock/unlock to gpusvm notifier lock: 931.045868 ===================================== 931.046509 WARNING: bad unlock balance detected! 931.047149...

CVE-2026-63854

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vcn: set nouserfence for VCN v3.0 enc/dec rings VCN encoder and decoder rings do not support 64-bit user fence writes, reject CS submissions with user fences. cherry picked from commit...

CVE-2026-63852

Summary: The CVE-2026-63852 entry relates to the Linux kernel DRM/AMDGPU VCN engine. The vulnerability arises because VCN encoder and decoder rings do not support 64-bit user fence writes, leading to rejected CS submissions when user fences are used. The root cause is identified as the change to ...

CVE-2026-63849

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vcn: set nouserfence for VCN v5.0.1 enc ring VCN encoder and decoder rings do not support 64-bit user fence writes, reject CS submissions with user fences. cherry picked from commit...

CVE-2026-63846

Summary: CVE-2026-63846 concerns the Linux kernel DRM/amdgpu JPEG v3.0 ring. The issue is that JPEG rings do not support 64-bit user fence writes, so submissions using user fences were rejected, which is the root cause described as a patch in the kernel commit (cherry picked from commit 4d7d774f1...