CVE-2026-99003 drm/panthor: validate userspace queue count against initialized firmware slot count

In the Linux kernel, the following vulnerability has been resolved: drm/panthor: validate userspace queue count against initialized firmware slot count In panthordrv.c:panthorioctlgroupcreate, the queue count is validated against the hardcoded maximum: if !args-queues.count || args-queues.count...

CVE-2026-99003 drm/panthor: validate userspace queue count against initialized firmware slot count

In the Linux kernel, the following vulnerability has been resolved: drm/panthor: validate userspace queue count against initialized firmware slot count In panthordrv.c:panthorioctlgroupcreate, the queue count is validated against the hardcoded maximum: if !args-queues.count || args-queues.count...

EUVD-2026-108796

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: validate pitch coming from userspace Validate the pitch, alongside the box dimensions before trying to copy data from the underlying surface. Fixes possible out of bounds reads with cursor snooping...

CVE-2026-99002

The Linux kernel contains a vulnerability in the drm/vmwgfx component where the system fails to properly validate the pitch provided from userspace. This lack of validation, alongside box dimensions, when copying data from the underlying surface, can lead to out-of-bounds reads during cursor snoo...

CVE-2026-99002 drm/vmwgfx: validate pitch coming from userspace

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: validate pitch coming from userspace Validate the pitch, alongside the box dimensions before trying to copy data from the underlying surface. Fixes possible out of bounds reads with cursor snooping...

CVE-2026-99002 drm/vmwgfx: validate pitch coming from userspace

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: validate pitch coming from userspace Validate the pitch, alongside the box dimensions before trying to copy data from the underlying surface. Fixes possible out of bounds reads with cursor snooping...

CVE-2026-99001

The Linux kernel contains a vulnerability in the drm/xe/i2c component where xe_i2c_remove() fails to drain i2c->work during teardown. This allows a queued or running work item to dereference i2c->adapter after it has been released by platform_device_unregister(). Additionally, because the w...

EUVD-2026-108795

In the Linux kernel, the following vulnerability has been resolved: drm/xe/i2c: cancel the client work on remove xei2cnotifier stores the DesignWare adapter in i2c-adapter and schedules i2c-work when the adapter is registered under the xe I2C platform device, and xei2cclientwork then instantiates...

CVE-2026-99001 drm/xe/i2c: cancel the client work on remove

In the Linux kernel, the following vulnerability has been resolved: drm/xe/i2c: cancel the client work on remove xei2cnotifier stores the DesignWare adapter in i2c-adapter and schedules i2c-work when the adapter is registered under the xe I2C platform device, and xei2cclientwork then instantiates...

CVE-2026-99001 drm/xe/i2c: cancel the client work on remove

In the Linux kernel, the following vulnerability has been resolved: drm/xe/i2c: cancel the client work on remove xei2cnotifier stores the DesignWare adapter in i2c-adapter and schedules i2c-work when the adapter is registered under the xe I2C platform device, and xei2cclientwork then instantiates...

EUVD-2026-108794

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix shrinker accounting double-subtraction on nested external pins xebopinexternal and xebounpinexternal support nested pins, since the underlying ttmbopin/ttmbounpin maintain a pincount refcount rather than a boolean...

CVE-2026-99000 drm/xe: Fix shrinker accounting double-subtraction on nested external pins

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix shrinker accounting double-subtraction on nested external pins xebopinexternal and xebounpinexternal support nested pins, since the underlying ttmbopin/ttmbounpin maintain a pincount refcount rather than a boolean...

CVE-2026-99000

The Linux kernel contains a vulnerability in the drm/xe driver where xe_bo_pin_external() and xe_bo_unpin_external() perform unconditional shrinker accounting calls on nested pins. Because external BOs (such as dma-buf ) can be pinned multiple times, these nested calls cause a double-subtraction ...

CVE-2026-99000 drm/xe: Fix shrinker accounting double-subtraction on nested external pins

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix shrinker accounting double-subtraction on nested external pins xebopinexternal and xebounpinexternal support nested pins, since the underlying ttmbopin/ttmbounpin maintain a pincount refcount rather than a boolean...

CVE-2026-98999 drm/xe: Fix stale pinned_link entry when fb-pin performs the final unpin

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix stale pinnedlink entry when fb-pin performs the final unpin xebopinexternal and xebounpinexternal maintain the bo's pinnedlink list membership in xe-pinned.late.external, based on whether the current call is the...

CVE-2026-98999

The Linux kernel contains a vulnerability in the drm/xe driver where a buffer object (bo ) can remain linked in the xe->pinned.late.external list indefinitely. This occurs when a bo is pinned both externally (e.g., dma-buf export) and as a framebuffer (fb ); if the external unpin occurs first,...

EUVD-2026-108793

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix stale pinnedlink entry when fb-pin performs the final unpin xebopinexternal and xebounpinexternal maintain the bo's pinnedlink list membership in xe-pinned.late.external, based on whether the current call is the...

CVE-2026-98998 drm/bridge: th1520-dw-hdmi: Fix remove() callback

In the Linux kernel, the following vulnerability has been resolved: drm/bridge: th1520-dw-hdmi: Fix remove callback This driver stores struct th1520hdmi in platform drvdata, but th1520dwhdmiremove was reading it back as struct dwhdmi and passing it to dwhdmiremove, so teardown runs on the wrong...

CVE-2026-98998

The Linux kernel contains a vulnerability in the drm/bridge: th1520-dw-hdmi driver. The issue stems from a type mismatch during the removal process: the driver stores a struct th1520_hdmi * in the platform drvdata, but the th1520_dw_hdmi_remove() function incorrectly reads it back as struct dw_hd...

EUVD-2026-108792

In the Linux kernel, the following vulnerability has been resolved: drm/bridge: th1520-dw-hdmi: Fix remove callback This driver stores struct th1520hdmi in platform drvdata, but th1520dwhdmiremove was reading it back as struct dwhdmi and passing it to dwhdmiremove, so teardown runs on the wrong...