CVE-2026-98180

CVE-2026-98180 — drm/msm: use-after-free of the scheduler-containing ring/VM objects A drmschedfence exported to userspace keeps a raw pointer to the drmgpuscheduler that produced it. In drm/msm that scheduler is embedded in struct msmringbuffer and struct msmgemvm, both of which were freed with ...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-151296)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-151296 advisory. In the Linux kernel, the following vulnerability has been resolved: iommu/msm: Unwind probe state on registration failure msmiommuprobe adds its devm-managed IOMMU...

CVE-2026-80886

A flaw was found in the Linux kernel's msm serial driver. A race condition can occur during concurrent writes from userspace and the kernel to the console Universal Asynchronous Receiver/Transmitter UART. This happens when userspace initiates a Direct Memory Access DMA transfer while the kernel's...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: serial: msm: Disable DMA for kernel console UART Currently, concurrent writes from user space and the kernel to the console can trigger a race condition that results in an infinite loop of the same messages being printed...

Astra Linux – vulnerability in linux-6.1, linux-6.12, linux-6.18

In the Linux kernel, the following vulnerability has been resolved: drm/msm/dsi: Drop devpmoppsetrate0 devpmoppsetrate0 removes the vote specified in required-opps but does not actually park the clock, making it run without the necessary power backing. Drop the explicit call to it. Every call sit...

Astra Linux – vulnerability in linux-6.12, linux-6.18

In the Linux kernel, the following vulnerability has been resolved: drm/msm/adreno: Fix a reference leak in a6xxgpuinit In a6xxgpuinit, node is obtained via ofparsephandle. While there was a manual ofnodeput at the end of the common path, several early error returns would bypass this call,...

Astra Linux – vulnerability in linux-6.12, linux-6.18

In the Linux kernel, the following vulnerability has been resolved: drm/msm: do not tear down KMS twice when KMS init fails When priv-kmsinit mdp4kmsinit / mdp5kmsinit fails partway through, both display drivers already tear their KMS state down via mdp4destroy / mdp5kmsdestroy before returning t...

CVE-2026-62337

SNARK Verifier is a generic SNARK verifier. Prior to 0.2.5, the Halo 2 aggregation circuit can mishandle proof points encoded as the point at infinity. EcPointLoader::multiscalarmultiplication places a Value::Assigned base paired with Value::ConstantONE into its unscaled variable-base list and...

CVE-2026-62337

The SNARK Verifier generic verifier is vulnerable to a flaw in the Halo 2 aggregation circuit prior to version 0.2.5 . The root cause is that EcPointLoader::multi_scalar_multiplication passes a base paired with Value::Constant(ONE) to sum_with_const, which delegates to halo2-lib's EccChip::sum. B...

PT-2026-134193

SNARK Verifier is a generic SNARK verifier. Prior to 0.2.5, the Halo 2 aggregation circuit can mishandle proof points encoded as the point at infinity. EcPointLoader::multi scalar multiplication places a Value::Assigned base paired with Value::ConstantONE into its unscaled variable-base list and...

CVE-2026-62337: axiom-crypto snark-verifier: SNARK Verifier is a generic (S)NARK verifier

SNARK Verifier is a generic SNARK verifier. Prior to 0.2.5, the Halo 2 aggregation circuit can mishandle proof points encoded as the point at infinity. EcPointLoader::multiscalarmultiplication places a Value::Assigned base paired with Value::ConstantONE into its unscaled variable-base list and...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-146657)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146657 advisory. In the Linux kernel, the following vulnerability has been resolved: iommu/msm: Unwind probe state on registration failure msmiommuprobe adds its devm-managed IOMMU...

CVE-2026-93058

A flaw was found in the Linux kernel's drm/msm component. When the drmschedinit function fails to complete the scheduler initialization, the system attempts to finalize a partially initialized scheduler. This can lead to an unstable state or a denial of service, as the teardown process assumes...

CVE-2026-90363

A flaw was found in the Linux kernel's drm/msm component. During the initialization of Kernel Mode Setting KMS, an error handling path attempts to deallocate resources twice. This double deallocation leads to a use-after-free error, which can cause a system crash. A local attacker could potential...

Astra Linux – vulnerability in linux-6.12

In the Linux kernel, the following vulnerability has been resolved: drm/msm/gem: fix error handling in msmioctlgeminfogetmetadata msmioctlgeminfogetmetadata always returns 0 regardless of errors. When copytouser fails or the user buffer is too small, the error code stored in ret is ignored becaus...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: drm/msm: Fix iommumapsgtable return value check and avoid WARN Commit “iommu: return full error code from iommumapsgatomic” changed iommumapsgtable to return an ssizet and negative values in error cases, rather than a sizet and a...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: drm/msm/dpu: fix mismatch between power and frequency During DPU runtime suspend, calling devpmoppsetratedev, 0 drops the MMCX rail to MINSVS while the core clock frequency remains at its original highest rate. When runtime resum...

Astra Linux – vulnerability in linux-5.10, linux-5.15, linux

In the Linux kernel, the following vulnerability has been resolved: drm: msm: fix possible memory leak in mdp5crtccursorset drmgemobjectlookup will call drmgemobjectget inside. So cursorbo needs to be put when msmgemgetandpiniova fails...

Astra Linux – vulnerability in linux-5.10, linux-5.15, linux

In the Linux kernel, the following vulnerability has been resolved: drm/msm/mdp5: Return error code in mdp5mixerrelease when a deadlock is detected There is a possibility for mdp5getglobalstate to return -EDEADLK when acquiring the modeset lock; however, currently globalstate in mdp5mixerrelease...

Astra Linux – Vulnerability in Linux, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: drm/msm: Fixed the issue of null pointer dereference on the pointer edp. The pointer dev is initialized, and the pointer edp is dereferenced before edp is checked for being null. This could lead to a null pointer dereference issu...