120 matches found
kernel: drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs()
A flaw was found in the Linux kernel's Direct Rendering Manager DRM Graphics Execution Manager GEM component. This vulnerability arises from an inconsistent calculation of plane dimensions, which can lead to incorrect memory allocation checks. A local attacker could exploit this by creating a...
kernel: drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs()
A flaw was found in the Linux kernel's Direct Rendering Manager DRM Graphics Execution Manager GEM component. This vulnerability arises from an inconsistent calculation of plane dimensions, which can lead to incorrect memory allocation checks. A local attacker could exploit this by creating a...
CVE-2026-63885
A flaw was found in the Linux kernel's Direct Rendering Manager DRM Graphics Execution Manager GEM component. A race condition, a situation where multiple operations occur in an unpredictable order, exists between the changehandle and handledelete operations. This can allow a local attacker to fr...
SUSE CVE-2026-63885
In the Linux kernel, the following vulnerability has been resolved: drm/gem: fix race between changehandle and handledelete drmgemchangehandleioctl leaves the old handle live in the IDR during the window between spinunlocktablelock and the final spinlocktablelock. A concurrent drmgemhandledelete ...
CVE-2026-63885 drm/gem: fix race between change_handle and handle_delete
In the Linux kernel, the following vulnerability has been resolved: drm/gem: fix race between changehandle and handledelete drmgemchangehandleioctl leaves the old handle live in the IDR during the window between spinunlocktablelock and the final spinlocktablelock. A concurrent drmgemhandledelete ...
CVE-2026-63885
The CVE concerns a race in the Linux kernel DRM GEM path: drm_gem_change_handle_ioctl can leave the old handle live in the IDR during the window after spin_unlock(table_lock) and before the final spin_lock(table_lock). A concurrent drm_gem_handle_delete on the old handle may decrement handle_coun...
CVE-2026-63880 drm/amdgpu: fix lock leak on ENOMEM in AMDGPU_GEM_OP_GET_MAPPING_INFO
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix lock leak on ENOMEM in AMDGPUGEMOPGETMAPPINGINFO The AMDGPUGEMOPGETMAPPINGINFO branch of amdgpugemopioctl holds three cleanup-tracked resources before calling kvcalloc: the drmgemobject reference from...
CVE-2026-46224
The CVE-2026-46224 issue affects the Linux kernel drm/xe driver. The bug is a lifecycle/ownership problem in xe_dma_buf_init_obj() where a pre-allocated storage bo is not freed when drm_gpuvm_resv_object_alloc() fails, leading to a potential resource leak. The kernel now ensures that, on failure,...
CVE-2026-46224
In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix bo leak in xedmabufinitobj on allocation failure When drmgpuvmresvobjectalloc fails, the pre-allocated storage bo is not freed. Add xebofreestorage before returning the error. xedmabufinitobj calls xeboinitlocked, whi...
Linux kernel 安全漏洞
The Linux kernel is the kernel used by the Linux operating system developed by the Linux Foundation in the United States. There is a security vulnerability in the Linux kernel, which stems from inconsistent calculations of plane dimensions in the drm/gem mechanism. This vulnerability may lead to...
PT-2026-44347
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A buffer object bo leak occurs in the xe dma buf init obj function. When drm gpuvm resv object alloc fails, the pre-allocated storage bo is not freed. Because xe gem prime import cannot...
Astra Linux – Vulnerability in Linux 5.10
In the Linux kernel, the following vulnerability has been resolved: drm/tests: shmem: Holding the reservation lock around madvise Acquiring and releasing the GEM object’s reservation lock during calls to the object’s madvide operation. The tests use drmgemshmemmadviselocked, which caused errors...
Astra Linux – Vulnerability in Linux 5.10
In the Linux kernel, the following vulnerability has been resolved: “Revert ‘drm/gem-framebuffer: Use dmabuf from GEM object instance’” This reversion is covered in the commit cce16fcd7446dcff7480cd9d2b6417075ed81065. The dmabuf field in the struct drmgemobject is not stable throughout the lifeti...
Astra Linux – Vulnerability in Linux 5.10
In the Linux kernel, the following vulnerabilities have been resolved: drm/panthor: Fixed a UAF in the panthorgemcreatewithhandle function’s debugfs code. The object may potentially have already been deleted after the drmgemobjectput call. In general, the object should be fully constructed before...
Astra Linux – Vulnerability in Linux 5.10
In the Linux kernel, the following vulnerability has been resolved: “Revert ‘drm/gem-dma: Use dmabuf from GEM object instance’” This change is reflected in commit e8afa1557f4f963c9a511bd2c6074a941c308685. The dmabuf field in the struct drmgemobject is not stable throughout the lifetime of the...
Astra Linux – Vulnerability in Linux 5.10
In the Linux kernel, the following vulnerability has been resolved: drm/msm: Fix bootup splat with separategpudrm modparam The drmgemforeachgpuvmbo call from lookupvma accesses drmgemobj.gpuva.list, which is not initialized when the drm driver does not support DRIVERGEMGPUVA feature. Enable it fo...
EUVD-2025-209745
In the Linux kernel, the following vulnerability has been resolved: drm/tests: shmem: Hold reservation lock around purge Acquire and release the GEM object's reservation lock around calls to the object's purge operation. The tests use drmgemshmempurgelocked, which led to errors such as show below...
EUVD-2025-209750
In the Linux kernel, the following vulnerability has been resolved: drm/tests: shmem: Hold reservation lock around vmap/vunmap Acquire and release the GEM object's reservation lock around vmap and vunmap operations. The tests use vmaplocked, which led to errors such as show below. 122.292030...
CVE-2026-43368 drm/i915: Fix potential overflow of shmem scatterlist length
In the Linux kernel, the following vulnerability has been resolved: drm/i915: Fix potential overflow of shmem scatterlist length When a scatterlists table of a GEM shmem object of size 4 GB or more is populated with pages allocated from a folio, unsigned int .length attribute of a scatterlist may...
CVE-2025-71296
In the Linux kernel, the following vulnerability has been resolved: drm/tests: shmem: Hold reservation lock around purge Acquire and release the GEM object's reservation lock around calls to the object's purge operation. The tests use drmgemshmempurgelocked, which led to errors such as show below...