CVE-2026-68260

CVE-2026-68260 affects the Linux kernel, specifically the drm/imagination driver. The issue arises because the GPU VM code does not properly synchronize find operations with map/unmap operations, allowing a race that can lead to a NULL pointer dereference in certain memory operations. The resolve...

CVE-2026-68260

In the Linux kernel, the following vulnerability has been resolved: drm/imagination: acquire vmctx-lock before mapping memory to GPU VM The drm gpuvm code doesn't protect find operation against map operation, and the driver needs to ensure a map operation shouldn't happen when a find operation is...

CVE-2026-68260 drm/imagination: acquire vm_ctx->lock before mapping memory to GPU VM

In the Linux kernel, the following vulnerability has been resolved: drm/imagination: acquire vmctx-lock before mapping memory to GPU VM The drm gpuvm code doesn't protect find operation against map operation, and the driver needs to ensure a map operation shouldn't happen when a find operation is...

CVE-2026-68259

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Check bounds in allocateeventnotificationslot The valid event ids go from 0 to KFDSIGNALEVENTLIMIT allocateeventnotificationslot has an option to specify an event id to allocate at, used by CRIU. We weren't checking t...

CVE-2026-68258

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Check bounds on CRIU restore queue type and mqd size We weren't checking whether the values provided in the private data in kfd CRIU restore were within bounds. For queue type, add a KFDQUEUETYPEMAX and ensure the...

CVE-2026-68257

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix 32-bit overflow in CWSR total size calculation totalcwsrsize was computed in 32-bit before being used as a BO/SVM allocation size. With large ctxsaverestoreareasize and debugmemorysize multiplied by the XCC count,...

CVE-2026-68256 drm/amd/display: detect_link_and_local_sink: DP alt mode timeout path leaks prev_sink reference

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: detectlinkandlocalsink: DP alt mode timeout path leaks prevsink reference prevsink is unconditionally retained via dcsinkretain at function entry, but the DP alt mode timeout path inside SIGNALTYPEDISPLAYPORT...

CVE-2026-68256

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: detectlinkandlocalsink: DP alt mode timeout path leaks prevsink reference prevsink is unconditionally retained via dcsinkretain at function entry, but the DP alt mode timeout path inside SIGNALTYPEDISPLAYPORT...

CVE-2026-68255 drm/virtio: bound EDID block reads to the response buffer

In the Linux kernel, the following vulnerability has been resolved: drm/virtio: bound EDID block reads to the response buffer virtiogetedidblock validates the read offset only against the device-supplied resp-size field, never against the fixed-size resp-edid array. The EDID block index is driven...

CVE-2026-68255 drm/virtio: bound EDID block reads to the response buffer

In the Linux kernel, the following vulnerability has been resolved: drm/virtio: bound EDID block reads to the response buffer virtiogetedidblock validates the read offset only against the device-supplied resp-size field, never against the fixed-size resp-edid array. The EDID block index is driven...

EUVD-2026-55356

In the Linux kernel, the following vulnerability has been resolved: drm/virtio: bound EDID block reads to the response buffer virtiogetedidblock validates the read offset only against the device-supplied resp-size field, never against the fixed-size resp-edid array. The EDID block index is driven...

CVE-2026-68255

In the Linux kernel, the following vulnerability has been resolved: drm/virtio: bound EDID block reads to the response buffer virtiogetedidblock validates the read offset only against the device-supplied resp-size field, never against the fixed-size resp-edid array. The EDID block index is driven...

CVE-2026-68254

In the Linux kernel, the following vulnerability has been resolved: drm/i915/vrr: require valid min/max vfreq for VRR Ensure the EDID provided min/max vfreq are valid. Most scenarios are already covered by coincidence through the checks in intelvrriscapable and intelvrrisinrange, but be more...

EUVD-2026-55354

In the Linux kernel, the following vulnerability has been resolved: drm/i915/hdcp: check streams bounds before overflow The data-streams overflow check is done after the buffer overflow has already happened. Move the overflow check before the write. Side note, emitting a warning splat with a...

CVE-2026-68253

In the Linux kernel, the following vulnerability has been resolved: drm/i915/hdcp: check streams bounds before overflow The data-streams overflow check is done after the buffer overflow has already happened. Move the overflow check before the write. Side note, emitting a warning splat with a...

CVE-2026-68252

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/sdma7.0: replace BUGON with WARNON There's no need to crash the kernel for these cases. cherry picked from commit 9723a8bed3aa251a26bee4583bac9d8fb064dd44...

CVE-2026-68251

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/sdma6.0: replace BUGON with WARNON There's no need to crash the kernel for these cases. cherry picked from commit c17a508a7d652da3728f8bbc481bfffe96d65a87...

CVE-2026-68250

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/sdma5.2: replace BUGON with WARNON There's no need to crash the kernel for these cases. cherry picked from commit ae658afc7f47f6147371ec42cc6b1a793dfdb5af...

CVE-2026-68249

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/sdma5.0: replace BUGON with WARNON There's no need to crash the kernel for these cases. cherry picked from commit 8d144a0eb09537055841af48c9e7c2d4cd48e84d...

CVE-2026-68248 drm/i915: Return NULL on error in active_instance

In the Linux kernel, the following vulnerability has been resolved: drm/i915: Return NULL on error in activeinstance Avoid returning &node-base when node is NULL due to OOM during GFPATOMIC allocation. Discovered using AI-assisted static analysis confirmed by Intel Product Security. cherry picked...