CVE-2026-74455

In the Linux kernel, the following vulnerability has been resolved: can: peakusb: validate uCAN receive record lengths pcanusbfddecodebuf walks uCAN records packed in one USB receive buffer. Require each record to contain the fixed header for its type, and verify CAN payload bytes before copying...

CVE-2026-74454

In the Linux kernel, the vulnerability CVE-2026-74454 affects the DRM VC4 path. The bug originates from vc4_overflow_mem_work() writing the overflow BO size to BPOS instead of the 512KB slot size in the 16MB binner BO, allowing the PTB to access memory beyond the first slot during binner out-of-m...

CVE-2026-74452

CVE-2026-74452 affects the Linux kernel in the drm/panthor firmware loading logic. The issue arises because section data size is computed as section->data.end - section->data.start without validating against allocated section_size. A crafted firmware could set data.size larger than allocate...

EUVD-2026-59645

In the Linux kernel, the following vulnerability has been resolved: drm/panthor: reject firmware sections with oversized data In panthorfwloadsectionentry, the data size to copy is calculated without validating it against the allocated sectionsize: section-data.size = hdr.data.end - hdr.data.star...

CVE-2026-74453 drm/vc4: Zero the tile state data array before each BIN job

In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Zero the tile state data array before each BIN job The binner BO is a single 16MB buffer split into 512KB slots that are handed out to jobs at submission time and recycled as jobs complete, without ever being cleared. Ea...

EUVD-2026-59646

In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Zero the tile state data array before each BIN job The binner BO is a single 16MB buffer split into 512KB slots that are handed out to jobs at submission time and recycled as jobs complete, without ever being cleared. Ea...

CVE-2026-74452 drm/panthor: reject firmware sections with oversized data

In the Linux kernel, the following vulnerability has been resolved: drm/panthor: reject firmware sections with oversized data In panthorfwloadsectionentry, the data size to copy is calculated without validating it against the allocated sectionsize: section-data.size = hdr.data.end - hdr.data.star...

CVE-2026-74451

The CVE-2026-74451 entry concerns the Linux kernel driver drm/panthor. The vulnerability arises because iface_fw_to_cpu_addr() only validates that the firmware MCU address lies within the shared section, while the returned pointer is used as a full firmware interface structure, allowing out-of-bo...

CVE-2026-74451

In the Linux kernel, the following vulnerability has been resolved: drm/panthor: validate firmware interface structure sizes ifacefwtocpuaddr only checks that the firmware-provided MCU virtual address points inside the shared section. The returned pointer is later used as a full firmware interfac...

CVE-2026-74450

In the Linux kernel, the following vulnerability has been resolved: drm/amd/pm: fix pptable use-after-free amdgpudpmgetpptable returns a pointer to a driver-owned power table after dropping adev-pm.mutex. The sysfs path then copies from that pointer. A concurrent pptable write can replace and fre...

CVE-2026-74450

Summary: CVE-2026-74450 affects the Linux kernel DRM/AMD PM path. The vulnerability arises when amdgpu_dpm_get_pp_table() returns a pointer to a driver-owned power table after dropping adev->pm.mutex. The sysfs interface copies from that pointer, and a concurrent pp_table write can replace and...

CVE-2026-74450 drm/amd/pm: fix pptable use-after-free

In the Linux kernel, the following vulnerability has been resolved: drm/amd/pm: fix pptable use-after-free amdgpudpmgetpptable returns a pointer to a driver-owned power table after dropping adev-pm.mutex. The sysfs path then copies from that pointer. A concurrent pptable write can replace and fre...

CVE-2026-74449

In CVE-2026-74449, the Linux kernel drm/amd/display pipeline has a divide-by-zero bug in calculate_mcache_setting when a zero-area viewport is processed. The function can exit with num_mcaches == 0 and mvmpg_width/height == 0, causing a divide-by-zero panic and potential underflow. The fix change...

EUVD-2026-59756

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix divide-by-zero in calculatemcachesetting on zero viewport If a plane reaches calculatemcachesetting with a zero-area viewport, calculatemcachesetting exits early with nummcaches == 0 and mvmpgwidth/height == ...

CVE-2026-74448

CVE-2026-74448 affects the Linux kernel’s DRM/amdkfd path. When MES is enabled and amdgpu_amdkfd_alloc_kernel_mem() fails during the first queue creation for a process, pqm_create_queue() may return early via a plain return, skipping the error cleanup and leaving a reserved QID bit set in queue_s...

EUVD-2026-59755

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix QID bit leak in pqmcreatequeue When MES is enabled and amdgpuamdkfdallockernelmem fails during the first queue creation for a process, pqmcreatequeue returns early via 'return retval' without going through the...

CVE-2026-74447

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix uint32t overflow in EOP ring buffer size alignment eopringbuffersize in struct queueproperties is a u32. In kfdqueueacquirebuffers the expected EOP buffer size is computed as ALIGNeopringbuffersize, PAGESIZE; ALIG...

CVE-2026-74447

CVE-2026-74447: In the Linux kernel, drm/amdkfd, the EOP ring buffer size alignment uses a 32-bit value, causing wrap when computing ALIGN(eop_ring_buffer_size, PAGE_SIZE). A user-supplied size like 0xFFFFF001 wraps to 0, letting kfd_queue_buffer_get() bypass the exact-size check and accept any B...

CVE-2026-74446

CVE-2026-74446 (Linux kernel, drm/amdkfd) resolves a race in kfd_criu_checkpoint_events where the code counts entries in p->event_idr and then walks the same IDR without holding p->event_mutex for the interval. A second thread could insert or remove events between the count and the walk, ca...

CVE-2026-74445

The CVE (CVE-2026-74445) affects the Linux kernel drm/vmwgfx path. The vulnerability arises when vmw_cmd_dx_bind_query() dereferences sw_context->dx_ctx_node->ctx if a DX_BIND_QUERY is submitted with dx_context_handle set to SVGA3D_INVALID_ID, allowing a NULL pointer dereference and kernel ...