CVE-2026-98511 drm/nouveau: don't bump pin count on failed re-pin in nouveau_bo_pin_locked()

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: don't bump pin count on failed re-pin in nouveaubopinlocked nouveaubopinlocked checks whether an already pinned BO is in a memory domain compatible with a new pin request. When the domains are incompatible, it sets...

CVE-2026-98511

The Linux kernel 's nouveau driver contains a vulnerability in the nouveau_bo_pin_locked() function. When an already pinned Buffer Object (BO) is requested to be moved to an incompatible memory domain, the function correctly returns -EBUSY but fails to prevent a call to ttm_bo_pin() . Consequentl...

EUVD-2026-103751

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: don't bump pin count on failed re-pin in nouveaubopinlocked nouveaubopinlocked checks whether an already pinned BO is in a memory domain compatible with a new pin request. When the domains are incompatible, it sets...

CVE-2026-98511 drm/nouveau: don't bump pin count on failed re-pin in nouveau_bo_pin_locked()

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: don't bump pin count on failed re-pin in nouveaubopinlocked nouveaubopinlocked checks whether an already pinned BO is in a memory domain compatible with a new pin request. When the domains are incompatible, it sets...

Linux-kernel-code-injection_CVE-2014-3153

This repository does not have a README...

CVE-2026-98510 drm/xe/vm: nuke PTs only after unlinking contested VMAs

In the Linux kernel, the following vulnerability has been resolved: drm/xe/vm: nuke PTs only after unlinking contested VMAs In xevmcloseandput, external-BO VMAs are queued on the contested list for deferred destruction via xevmadestroyunlocked. However, xevmptdestroy was previously invoked before...

EUVD-2026-103750

In the Linux kernel, the following vulnerability has been resolved: drm/xe/vm: nuke PTs only after unlinking contested VMAs In xevmcloseandput, external-BO VMAs are queued on the contested list for deferred destruction via xevmadestroyunlocked. However, xevmptdestroy was previously invoked before...

CVE-2026-98510 drm/xe/vm: nuke PTs only after unlinking contested VMAs

In the Linux kernel, the following vulnerability has been resolved: drm/xe/vm: nuke PTs only after unlinking contested VMAs In xevmcloseandput, external-BO VMAs are queued on the contested list for deferred destruction via xevmadestroyunlocked. However, xevmptdestroy was previously invoked before...

CVE-2026-98510

The Linux kernel contains a race condition in the drm/xe/vm component. In xe_vm_close_and_put(), xe_vm_pt_destroy() was incorrectly invoked before processing contested VMAs, destroying vm->pt_root while VMAs remained linked to buffer objects. If a concurrent thread evicts a shared buffer objec...

CVE-2026-98509 drm/virtio: fix memory leak of fence event on execbuffer failure

In the Linux kernel, the following vulnerability has been resolved: drm/virtio: fix memory leak of fence event on execbuffer failure virtiogpuexecbufferioctl reserves a DRM event with drmeventreserveinit when VIRTGPUEXECBUFRINGIDX selects a ring that userspace has enabled polling for...

EUVD-2026-103749

In the Linux kernel, the following vulnerability has been resolved: drm/virtio: fix memory leak of fence event on execbuffer failure virtiogpuexecbufferioctl reserves a DRM event with drmeventreserveinit when VIRTGPUEXECBUFRINGIDX selects a ring that userspace has enabled polling for...

CVE-2026-98509

A memory leak vulnerability exists in the Linux kernel 's drm/virtio component. The issue occurs in virtio_gpu_execbuffer_ioctl() when a DRM event is reserved via drm_event_reserve_init() for a ring enabled for polling. Because virtio_gpu_init_submit() performs this reservation before processing ...

CVE-2026-98509 drm/virtio: fix memory leak of fence event on execbuffer failure

In the Linux kernel, the following vulnerability has been resolved: drm/virtio: fix memory leak of fence event on execbuffer failure virtiogpuexecbufferioctl reserves a DRM event with drmeventreserveinit when VIRTGPUEXECBUFRINGIDX selects a ring that userspace has enabled polling for...

CVE-2026-98508 drm/virtio: fix NULL pointer dereference on fence allocation failure

In the Linux kernel, the following vulnerability has been resolved: drm/virtio: fix NULL pointer dereference on fence allocation failure virtiogpufencealloc can fail due to memory pressure and return NULL, but its caller like virtiogpuinitsubmit never checks it. Later, virtiogpuinitsubmit passes...

CVE-2026-98508 drm/virtio: fix NULL pointer dereference on fence allocation failure

In the Linux kernel, the following vulnerability has been resolved: drm/virtio: fix NULL pointer dereference on fence allocation failure virtiogpufencealloc can fail due to memory pressure and return NULL, but its caller like virtiogpuinitsubmit never checks it. Later, virtiogpuinitsubmit passes...

CVE-2026-98508

The Linux kernel contains a vulnerability in the drm/virtio component where a NULL pointer dereference occurs during fence allocation failures. Specifically, the function virtio_gpu_fence_alloc() can return NULL under memory pressure, but the caller virtio_gpu_init_submit() fails to validate this...

EUVD-2026-103748

In the Linux kernel, the following vulnerability has been resolved: drm/virtio: fix NULL pointer dereference on fence allocation failure virtiogpufencealloc can fail due to memory pressure and return NULL, but its caller like virtiogpuinitsubmit never checks it. Later, virtiogpuinitsubmit passes...

EUVD-2026-103747

In the Linux kernel, the following vulnerability has been resolved: mm/rmap: fix missing barrier between anonvma init and vma-anonvma publish On arm64 server, we find that a task trying to grab the anonvma lock triggers hungtask. INFO: task main:2354726 blocked for more than 120 seconds. Tainted:...

CVE-2026-98507

The Linux kernel is susceptible to a race condition in the mm/rmap component on arm64 servers. The vulnerability exists because a missing memory barrier between the initialization of anon_vma and its publication to vma->anon_vma allows for memory reordering. Specifically, a thread can observe ...

CVE-2026-98507 mm/rmap: fix missing barrier between anon_vma init and vma->anon_vma publish

In the Linux kernel, the following vulnerability has been resolved: mm/rmap: fix missing barrier between anonvma init and vma-anonvma publish On arm64 server, we find that a task trying to grab the anonvma lock triggers hungtask. INFO: task main:2354726 blocked for more than 120 seconds. Tainted:...