CVE-2026-99006

A vulnerability exists in the Linux kernel within the drm/i915/gem component. The issue is caused by the eb_relocate_parse_slow() function potentially calling kvfree() on entries outside the original exec array. This occurs because eb_parse() appends up to two VMAs after incrementing eb->buffe...

CVE-2026-99006 drm/i915/gem: Prevent overstepping exec array boundary

In the Linux kernel, the following vulnerability has been resolved: drm/i915/gem: Prevent overstepping exec array boundary It is possible for ebrelocateparseslow to call kvfree on entries outside the original exec array during following scenario inside ebrelocateparseslow: 1 ebcopyrelocations...

EUVD-2026-108800

In the Linux kernel, the following vulnerability has been resolved: drm/i915/gem: Prevent overstepping exec array boundary It is possible for ebrelocateparseslow to call kvfree on entries outside the original exec array during following scenario inside ebrelocateparseslow: 1 ebcopyrelocations...

CVE-2026-99006 drm/i915/gem: Prevent overstepping exec array boundary

In the Linux kernel, the following vulnerability has been resolved: drm/i915/gem: Prevent overstepping exec array boundary It is possible for ebrelocateparseslow to call kvfree on entries outside the original exec array during following scenario inside ebrelocateparseslow: 1 ebcopyrelocations...

CVE-2026-99005

The Linux kernel (specifically the drm/i915 driver) contains a race condition where rps_work() can be triggered after a Graphics_Technology (GT) unit has been parked. This occurs because of a small window between intel_rps_boost() reading a stale ACTIVE state and queuing the work. If the race con...

EUVD-2026-108799

In the Linux kernel, the following vulnerability has been resolved: drm/i915/gt: Unmask interrupts only when ACTIVE is true There is a small race window between intelrpsboost reading a stale ACTIVE state and queuing rps-work, where ACTIVE may be changed via asynchronous calls triggered by wakeref...

CVE-2026-99005 drm/i915/gt: Unmask interrupts only when ACTIVE is true

In the Linux kernel, the following vulnerability has been resolved: drm/i915/gt: Unmask interrupts only when ACTIVE is true There is a small race window between intelrpsboost reading a stale ACTIVE state and queuing rps-work, where ACTIVE may be changed via asynchronous calls triggered by wakeref...

EUVD-2026-108798

In the Linux kernel, the following vulnerability has been resolved: drm/imagination: Size page table preallocation by device address Commit 0a8224058a58 "drm/imagination: Fix page count for page table for map interface" passed the device address to pvrmmuopcontextcreate, but the preallocation is...

CVE-2026-99004

The Linux kernel contains a vulnerability in the drm/imagination driver related to how page table preallocation is sized by device address. The root cause involves an incorrect calculation where preallocation was sized from device_addr + sgt_offset with an exclusive end, causing the allocation of...

CVE-2026-99004 drm/imagination: Size page table preallocation by device address

In the Linux kernel, the following vulnerability has been resolved: drm/imagination: Size page table preallocation by device address Commit 0a8224058a58 "drm/imagination: Fix page count for page table for map interface" passed the device address to pvrmmuopcontextcreate, but the preallocation is...

CVE-2026-99003

The Linux kernel contains a vulnerability in the drm/panthor driver within the panthor_drv.c:panthor_ioctl_group_create() function. The driver incorrectly validates the userspace queue count against a hardcoded maximum (MAX_CS_PER_CSG) instead of the actual number of slots reported by the firmwar...

EUVD-2026-108797

In the Linux kernel, the following vulnerability has been resolved: drm/panthor: validate userspace queue count against initialized firmware slot count In panthordrv.c:panthorioctlgroupcreate, the queue count is validated against the hardcoded maximum: if !args-queues.count || args-queues.count...

CVE-2026-99003 drm/panthor: validate userspace queue count against initialized firmware slot count

In the Linux kernel, the following vulnerability has been resolved: drm/panthor: validate userspace queue count against initialized firmware slot count In panthordrv.c:panthorioctlgroupcreate, the queue count is validated against the hardcoded maximum: if !args-queues.count || args-queues.count...

EUVD-2026-108796

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: validate pitch coming from userspace Validate the pitch, alongside the box dimensions before trying to copy data from the underlying surface. Fixes possible out of bounds reads with cursor snooping...

CVE-2026-99002

The Linux kernel contains a vulnerability in the drm/vmwgfx component where the system fails to properly validate the pitch provided from userspace. This lack of validation, alongside box dimensions, when copying data from the underlying surface, can lead to out-of-bounds reads during cursor snoo...

CVE-2026-99002 drm/vmwgfx: validate pitch coming from userspace

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: validate pitch coming from userspace Validate the pitch, alongside the box dimensions before trying to copy data from the underlying surface. Fixes possible out of bounds reads with cursor snooping...

CVE-2026-99002 drm/vmwgfx: validate pitch coming from userspace

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: validate pitch coming from userspace Validate the pitch, alongside the box dimensions before trying to copy data from the underlying surface. Fixes possible out of bounds reads with cursor snooping...

EUVD-2026-108795

In the Linux kernel, the following vulnerability has been resolved: drm/xe/i2c: cancel the client work on remove xei2cnotifier stores the DesignWare adapter in i2c-adapter and schedules i2c-work when the adapter is registered under the xe I2C platform device, and xei2cclientwork then instantiates...

CVE-2026-99001

The Linux kernel contains a vulnerability in the drm/xe/i2c component where xe_i2c_remove() fails to drain i2c->work during teardown. This allows a queued or running work item to dereference i2c->adapter after it has been released by platform_device_unregister(). Additionally, because the w...

CVE-2026-99001 drm/xe/i2c: cancel the client work on remove

In the Linux kernel, the following vulnerability has been resolved: drm/xe/i2c: cancel the client work on remove xei2cnotifier stores the DesignWare adapter in i2c-adapter and schedules i2c-work when the adapter is registered under the xe I2C platform device, and xei2cclientwork then instantiates...