CVE-2026-74455

The CVE-2026-74455 vulnerability in the Linux kernel concerns the peak_usb driver for CAN (uCAN) payloads. pcan_usb_fd_decode_buf() parses multiple CAN records packed in a single USB receive buffer and now requires each record to include the fixed header for its type and validates the CAN payload...

CVE-2026-74455 can: peak_usb: validate uCAN receive record lengths

In the Linux kernel, the following vulnerability has been resolved: can: peakusb: validate uCAN receive record lengths pcanusbfddecodebuf walks uCAN records packed in one USB receive buffer. Require each record to contain the fixed header for its type, and verify CAN payload bytes before copying...

EUVD-2026-59648

In the Linux kernel, the following vulnerability has been resolved: can: peakusb: validate uCAN receive record lengths pcanusbfddecodebuf walks uCAN records packed in one USB receive buffer. Require each record to contain the fixed header for its type, and verify CAN payload bytes before copying...

CVE-2026-74455 can: peak_usb: validate uCAN receive record lengths

In the Linux kernel, the following vulnerability has been resolved: can: peakusb: validate uCAN receive record lengths pcanusbfddecodebuf walks uCAN records packed in one USB receive buffer. Require each record to contain the fixed header for its type, and verify CAN payload bytes before copying...

CVE-2026-74454

CVE-2026-74454 affects the Linux kernel driv3rs/drm vc4 by correcting how the overflow slot size is written during binner memory handling. The issue arises when vc4_overflow_mem_work() sets BPOA to a 512KB slot but BPOS stores the size of the entire 16MB binner BO, enabling the PTB to write tile ...

CVE-2026-74454

In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO size vc4overflowmemwork points BPOA at a 512KB slot inside the 16MB binner BO, but writes the size of the whole BO to BPOS. On every binner out-of-memory event...

CVE-2026-74454 drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO size

In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO size vc4overflowmemwork points BPOA at a 512KB slot inside the 16MB binner BO, but writes the size of the whole BO to BPOS. On every binner out-of-memory event...

CVE-2026-74454 drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO size

In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO size vc4overflowmemwork points BPOA at a 512KB slot inside the 16MB binner BO, but writes the size of the whole BO to BPOS. On every binner out-of-memory event...

CVE-2026-74452 drm/panthor: reject firmware sections with oversized data

In the Linux kernel, the following vulnerability has been resolved: drm/panthor: reject firmware sections with oversized data In panthorfwloadsectionentry, the data size to copy is calculated without validating it against the allocated sectionsize: section-data.size = hdr.data.end - hdr.data.star...

CVE-2026-74452

The CVE-2026-74452 issue affects the Linux kernel DRM Panthor firmware loading. In panthor_fw_load_section_entry(), the copied data size is computed as hdr.data.end - hdr.data.start without validating against the allocated section_size, permitting a crafted firmware to set section->data.size l...

EUVD-2026-59645

In the Linux kernel, the following vulnerability has been resolved: drm/panthor: reject firmware sections with oversized data In panthorfwloadsectionentry, the data size to copy is calculated without validating it against the allocated sectionsize: section-data.size = hdr.data.end - hdr.data.star...

CVE-2026-74452 drm/panthor: reject firmware sections with oversized data

In the Linux kernel, the following vulnerability has been resolved: drm/panthor: reject firmware sections with oversized data In panthorfwloadsectionentry, the data size to copy is calculated without validating it against the allocated sectionsize: section-data.size = hdr.data.end - hdr.data.star...

CVE-2026-74453 drm/vc4: Zero the tile state data array before each BIN job

In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Zero the tile state data array before each BIN job The binner BO is a single 16MB buffer split into 512KB slots that are handed out to jobs at submission time and recycled as jobs complete, without ever being cleared. Ea...

EUVD-2026-59754

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix uint32t overflow in EOP ring buffer size alignment eopringbuffersize in struct queueproperties is a u32. In kfdqueueacquirebuffers the expected EOP buffer size is computed as ALIGNeopringbuffersize, PAGESIZE; ALIG...

CVE-2026-74447

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix uint32t overflow in EOP ring buffer size alignment eopringbuffersize in struct queueproperties is a u32. In kfdqueueacquirebuffers the expected EOP buffer size is computed as ALIGNeopringbuffersize, PAGESIZE; ALIG...

CVE-2026-74447 drm/amdkfd: fix uint32_t overflow in EOP ring buffer size alignment

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix uint32t overflow in EOP ring buffer size alignment eopringbuffersize in struct queueproperties is a u32. In kfdqueueacquirebuffers the expected EOP buffer size is computed as ALIGNeopringbuffersize, PAGESIZE; ALIG...

CVE-2026-74447

In the Linux kernel (drm/amdkfd), a uint32_t overflow in EOP ring buffer size alignment was fixed. The issue occurred because eop_ring_buffer_size (u32) is aligned with PAGE_SIZE in kfd_queue_acquire_buffers() using 32‑bit arithmetic, allowing a user size like 0xFFFFF001 to wrap to 0 and bypass t...

CVE-2026-74447 drm/amdkfd: fix uint32_t overflow in EOP ring buffer size alignment

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix uint32t overflow in EOP ring buffer size alignment eopringbuffersize in struct queueproperties is a u32. In kfdqueueacquirebuffers the expected EOP buffer size is computed as ALIGNeopringbuffersize, PAGESIZE; ALIG...

CVE-2026-74446

The CVE-2026-74446 issue affects the Linux kernel DRM/AMDKFD path and is triggered in kfd_criu_checkpoint_events() when checkpointing CRIU events. The root cause is that kfd_criu_checkpoint_events() counts entries in p->event_idr without holding p->event_mutex, and later iterates the same I...

CVE-2026-74446 drm/amdkfd: hold event_mutex while checkpointing CRIU events

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: hold eventmutex while checkpointing CRIU events kfdcriucheckpointevents counts the entries in p-eventidr via kfdgetnumevents, allocates an array sized to that count, and then walks the same IDR to fill it. Neither the...