CVE-2026-98513

The Linux kernel contains a vulnerability in the drm/nouveau driver within the nouveau_connector_detect() function. The root cause is a runtime PM leak occurring when nvif_outp_edid_get() fails, as the function returns early without dropping the runtime PM reference acquired at the start. This ca...

CVE-2026-98513 drm/nouveau: Fix runtime PM leak in nouveau_connector_detect()

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: Fix runtime PM leak in nouveauconnectordetect If nvifoutpedidget fails, nouveauconnectordetect returns early without dropping the runtime PM reference taken at the start of the function, keeping the device powered on...

EUVD-2026-103753

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: Fix runtime PM leak in nouveauconnectordetect If nvifoutpedidget fails, nouveauconnectordetect returns early without dropping the runtime PM reference taken at the start of the function, keeping the device powered on...

CVE-2026-98513 drm/nouveau: Fix runtime PM leak in nouveau_connector_detect()

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: Fix runtime PM leak in nouveauconnectordetect If nvifoutpedidget fails, nouveauconnectordetect returns early without dropping the runtime PM reference taken at the start of the function, keeping the device powered on...

CVE-2026-98512 drm/nouveau: RCU-free the scheduler-containing nouveau_sched

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: RCU-free the scheduler-containing nouveausched struct nouveausched embeds a struct drmgpuscheduler base. nouveauscheddestroy calls nouveauschedfini which does drmschedfini&sched-base and then frees the object with...

CVE-2026-98512

The Linux kernel contains a vulnerability in the drm/nouveau component where the nouveau_sched object is improperly freed using kfree() instead of kfree_rcu(). Because nouveau_sched_destroy() calls nouveau_sched_fini() before freeing the object, a finished fence exported to userspace via drm_sync...

EUVD-2026-103752

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: RCU-free the scheduler-containing nouveausched struct nouveausched embeds a struct drmgpuscheduler base. nouveauscheddestroy calls nouveauschedfini which does drmschedfini&sched-base and then frees the object with...

CVE-2026-98512 drm/nouveau: RCU-free the scheduler-containing nouveau_sched

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: RCU-free the scheduler-containing nouveausched struct nouveausched embeds a struct drmgpuscheduler base. nouveauscheddestroy calls nouveauschedfini which does drmschedfini&sched-base and then frees the object with...

CVE-2026-98511 drm/nouveau: don't bump pin count on failed re-pin in nouveau_bo_pin_locked()

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: don't bump pin count on failed re-pin in nouveaubopinlocked nouveaubopinlocked checks whether an already pinned BO is in a memory domain compatible with a new pin request. When the domains are incompatible, it sets...

CVE-2026-98511

The Linux kernel 's nouveau driver contains a vulnerability in the nouveau_bo_pin_locked() function. When an already pinned Buffer Object (BO) is requested to be moved to an incompatible memory domain, the function correctly returns -EBUSY but fails to prevent a call to ttm_bo_pin() . Consequentl...

CVE-2026-98511 drm/nouveau: don't bump pin count on failed re-pin in nouveau_bo_pin_locked()

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: don't bump pin count on failed re-pin in nouveaubopinlocked nouveaubopinlocked checks whether an already pinned BO is in a memory domain compatible with a new pin request. When the domains are incompatible, it sets...

EUVD-2026-103751

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: don't bump pin count on failed re-pin in nouveaubopinlocked nouveaubopinlocked checks whether an already pinned BO is in a memory domain compatible with a new pin request. When the domains are incompatible, it sets...

Linux-kernel-code-injection_CVE-2014-3153

This repository does not have a README...

CVE-2026-98510 drm/xe/vm: nuke PTs only after unlinking contested VMAs

In the Linux kernel, the following vulnerability has been resolved: drm/xe/vm: nuke PTs only after unlinking contested VMAs In xevmcloseandput, external-BO VMAs are queued on the contested list for deferred destruction via xevmadestroyunlocked. However, xevmptdestroy was previously invoked before...

CVE-2026-98510 drm/xe/vm: nuke PTs only after unlinking contested VMAs

In the Linux kernel, the following vulnerability has been resolved: drm/xe/vm: nuke PTs only after unlinking contested VMAs In xevmcloseandput, external-BO VMAs are queued on the contested list for deferred destruction via xevmadestroyunlocked. However, xevmptdestroy was previously invoked before...

EUVD-2026-103750

In the Linux kernel, the following vulnerability has been resolved: drm/xe/vm: nuke PTs only after unlinking contested VMAs In xevmcloseandput, external-BO VMAs are queued on the contested list for deferred destruction via xevmadestroyunlocked. However, xevmptdestroy was previously invoked before...

CVE-2026-98510

The Linux kernel contains a race condition in the drm/xe/vm component. In xe_vm_close_and_put(), xe_vm_pt_destroy() was incorrectly invoked before processing contested VMAs, destroying vm->pt_root while VMAs remained linked to buffer objects. If a concurrent thread evicts a shared buffer objec...

EUVD-2026-103749

In the Linux kernel, the following vulnerability has been resolved: drm/virtio: fix memory leak of fence event on execbuffer failure virtiogpuexecbufferioctl reserves a DRM event with drmeventreserveinit when VIRTGPUEXECBUFRINGIDX selects a ring that userspace has enabled polling for...

CVE-2026-98509 drm/virtio: fix memory leak of fence event on execbuffer failure

In the Linux kernel, the following vulnerability has been resolved: drm/virtio: fix memory leak of fence event on execbuffer failure virtiogpuexecbufferioctl reserves a DRM event with drmeventreserveinit when VIRTGPUEXECBUFRINGIDX selects a ring that userspace has enabled polling for...

CVE-2026-98509 drm/virtio: fix memory leak of fence event on execbuffer failure

In the Linux kernel, the following vulnerability has been resolved: drm/virtio: fix memory leak of fence event on execbuffer failure virtiogpuexecbufferioctl reserves a DRM event with drmeventreserveinit when VIRTGPUEXECBUFRINGIDX selects a ring that userspace has enabled polling for...