EUVD-2026-59563

In the Linux kernel, the following vulnerability has been resolved: drm/radeon: fix memory leak in radeonringrestore on lock failure radeonringrestore takes ownership of the data buffer allocated by radeonringbackup. The caller radeongpureset only frees it in the non-restore branch; in the restor...

CVE-2026-74416 drm/radeon: fix memory leak in radeon_ring_restore() on lock failure

In the Linux kernel, the following vulnerability has been resolved: drm/radeon: fix memory leak in radeonringrestore on lock failure radeonringrestore takes ownership of the data buffer allocated by radeonringbackup. The caller radeongpureset only frees it in the non-restore branch; in the restor...

CVE-2026-74416 drm/radeon: fix memory leak in radeon_ring_restore() on lock failure

In the Linux kernel, the following vulnerability has been resolved: drm/radeon: fix memory leak in radeonringrestore on lock failure radeonringrestore takes ownership of the data buffer allocated by radeonringbackup. The caller radeongpureset only frees it in the non-restore branch; in the restor...

CVE-2026-74416

CVE-2026-74416 affects the Linux kernel DRM/Radeon stack. The vulnerability is a memory-leak in radeon_ring_restore() on lock failure: radeon_ring_restore() takes ownership of the buffer allocated by radeon_ring_backup(), but when radeon_ring_lock() fails it returns early and does not kvfree(data...

CVE-2026-74381

The CVE-2026-74381 entry describes a Linux kernel vulnerability in gpu: host1x where entries in BO caches could be freed. A mapping pinned via host1x_bo_pin() with a cache kept a reference to the underlying host1x_bo, preventing theBO from being freed as long as cached. The fix introduces a weak ...

CVE-2026-74380 gpu: host1x: Fix iommu_map_sgtable() return value check

In the Linux kernel, the following vulnerability has been resolved: gpu: host1x: Fix iommumapsgtable return value check Commit "iommu: return full error code from iommumapsgatomic" changed iommumapsgtable to return an ssizet and negative values in error cases, rather than a sizet and a zero. pinj...

EUVD-2026-59504

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix KASAN slab-out-of-bounds in amdgpucoredump ring dump The ring content dump in amdgpucoredump uses two separate loops over adev-rings: the first counts rings with unsignalled fences to size the allocation, and the...

CVE-2026-74357 drm/amdgpu: fix KASAN slab-out-of-bounds in amdgpu_coredump ring dump

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix KASAN slab-out-of-bounds in amdgpucoredump ring dump The ring content dump in amdgpucoredump uses two separate loops over adev-rings: the first counts rings with unsignalled fences to size the allocation, and the...

CVE-2026-74357 drm/amdgpu: fix KASAN slab-out-of-bounds in amdgpu_coredump ring dump

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix KASAN slab-out-of-bounds in amdgpucoredump ring dump The ring content dump in amdgpucoredump uses two separate loops over adev-rings: the first counts rings with unsignalled fences to size the allocation, and the...

CVE-2026-74353 drm/amdkfd: always resume_all after suspend_all

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: always resumeall after suspendall Need to restore any good queues even if the suspendall failed for some. Always run removequeue as that will schedule a GPU reset is removing the queue fails. v2: move resumeall after...

CVE-2026-74353

The CVE-2026-74353 entry concerns the Linux kernel component drm/amdkfd. The issue arises from an incorrect flow around suspend_all/resume_all: the fix ensures that queues are restored even if suspend_all fails and that remove_queue is always run because it can trigger a GPU reset if removing the...

CVE-2026-74353 drm/amdkfd: always resume_all after suspend_all

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: always resumeall after suspendall Need to restore any good queues even if the suspendall failed for some. Always run removequeue as that will schedule a GPU reset is removing the queue fails. v2: move resumeall after...

EUVD-2026-59500

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: always resumeall after suspendall Need to restore any good queues even if the suspendall failed for some. Always run removequeue as that will schedule a GPU reset is removing the queue fails. v2: move resumeall after...

CVE-2026-72388

The CVE-2026-72388 entry concerns the Linux kernel DRM/Panthor driver. Root cause: when acquiring the dma_fence lock, drivers can be reached from hardirq context, requiring the IRQ-safe variant and a guard-model switch. Affected component is drm/panthor in the kernel’s fence handling; fix involve...

EUVD-2026-59285

In the Linux kernel, the following vulnerability has been resolved: drm/panthor: Fix a leak when a group is evicted before the tiler OOM is serviced A group ref is tied to the pending tileroomwork, so we need to release it if the cancel was effective...

CVE-2026-72358 drm/xe/pt: prevent invalid cursor access for purged BOs

In the Linux kernel, the following vulnerability has been resolved: drm/xe/pt: prevent invalid cursor access for purged BOs During a page table walk for binding, xeptstagebind explicitly skips initializing the xerescursor for purged BOs, treating them similarly to NULL VMAs by only setting the...

EUVD-2026-59257

In the Linux kernel, the following vulnerability has been resolved: drm/xe/pt: prevent invalid cursor access for purged BOs During a page table walk for binding, xeptstagebind explicitly skips initializing the xerescursor for purged BOs, treating them similarly to NULL VMAs by only setting the...

CVE-2026-72245

CVE-2026-72245 relates to the Linux kernel GPU host1x driver, where a reference leak could occur in host1x_device_parse_dt() after device_initialize(). The embedded struct device was freed directly via kfree(device) in the error path, bypassing normal device lifetime handling and leaking a refere...

CVE-2026-72244 gpu/buddy: bail out of try_harder when alignment cannot be honoured

In the Linux kernel, the following vulnerability has been resolved: gpu/buddy: bail out of tryharder when alignment cannot be honoured The tryharder contiguous fallback could return a range whose start offset did not match the caller's minblocksize. When a candidate's start is misaligned, realign...

CVE-2026-72244

CVE-2026-72244 concerns the Linux kernel gpu/buddy allocator. The bug in try_harder contiguous fallback could return a range whose start offset didn’t match the caller’s min_block_size. The fix realigns misaligned candidates by freeing the misaligned run and reallocating exactly @size at the next...