CVE-2026-68266 drm/xe: Hold a dma-buf reference for imported BOs

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Hold a dma-buf reference for imported BOs An imported dma-buf BO is created as a ttmbotypesg BO whose reservation object is the exporter's dmabuf-resv. The importer, however, only takes a dma-buf reference after a...

CVE-2026-68266

CVE-2026-68266 is a Linux kernel vulnerability in the drm/xe path with imported dma-buf BOs. The issue arises when an imported dma-buf BO is created as a ttm_bo_type_sg object whose reservation (exporter’s resv) is not kept alive until dma_buf_dynamic_attach completes. If the exporter is freed wh...

CVE-2026-68239 drm/ttm: Account for NULL and handle pages in ttm_pool_backup

In the Linux kernel, the following vulnerability has been resolved: drm/ttm: Account for NULL and handle pages in ttmpoolbackup Pages in ttmpoolbackup can be NULL or backup handles ttmbackuppageptrishandle, neither of which can be passed to setpagesarraywb or freed. Add a dedicated WB pass before...

CVE-2026-68239 drm/ttm: Account for NULL and handle pages in ttm_pool_backup

In the Linux kernel, the following vulnerability has been resolved: drm/ttm: Account for NULL and handle pages in ttmpoolbackup Pages in ttmpoolbackup can be NULL or backup handles ttmbackuppageptrishandle, neither of which can be passed to setpagesarraywb or freed. Add a dedicated WB pass before...

CVE-2026-68239

CVE-2026-68239 affects the Linux kernel DRM TTM code, specifically the ttm_pool_backup path. The issue arises because ttm_pool_backup could encounter NULL or backup handle entries (ttm_backup_page_ptr_is_handle()) which were not safely guarded for set_pages_array_wb() and could be freed erroneous...

CVE-2026-68234 drm/amdgpu: fix bo->pin leaking in amdgpu_bo_create_reserved

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix bo-pin leaking in amdgpubocreatereserved amdgpubocreatereserved only allocates a new BO when boptr struct amdgpubo boptr as input parameter is NULL, it simply skips creation when boptr is non-NULL. But it...

The vulnerability of the ttm_bo_swapout() function in the drivers/gpu/drm/ttm/ttm_bo.c file of the Direct Rendering Infrastructure (DRI) driver for the Linux operating system allows a attacker to cause a service failure.

The vulnerability of the ttmboswapout function in the drivers/gpu/drm/ttm/ttmbo.c file of the Direct Rendering Infrastructure DRI driver for the Linux kernel is related to improper memory release memory leak. Exploiting this vulnerability can allow an attacker to cause a system failure...

CVE-2026-63884

A flaw was found in the Linux kernel's Intel i915 graphics driver drm/i915. This use-after-free UAF vulnerability occurs during the TTM object purge operation. An attacker could potentially exploit this to cause a system crash, leading to a denial of service...

SUSE CVE-2026-63884

In the Linux kernel, the following vulnerability has been resolved: drm/i915: Fix potential UAF in TTM object purge TLDR: The bo-ttm object might be changed by calling ttmbovalidate, move casting it to an i915tt object later to actually get the right pointer. A user reported hitting the following...

EUVD-2026-45769

In the Linux kernel, the following vulnerability has been resolved: drm/i915: Fix potential UAF in TTM object purge TLDR: The bo-ttm object might be changed by calling ttmbovalidate, move casting it to an i915tt object later to actually get the right pointer. A user reported hitting the following...

CVE-2026-63884

CVE-2026-63884 affects the Linux kernel i915 driver with a UAF risk during TTM object purge. The issue arises when a bo->ttm object is mutated by ttm_bo_validate() and then cast to an i915_tt pointer, leading to a dereference after the object’s placement/caching policy may be changed (eviction...

CVE-2026-63884 drm/i915: Fix potential UAF in TTM object purge

In the Linux kernel, the following vulnerability has been resolved: drm/i915: Fix potential UAF in TTM object purge TLDR: The bo-ttm object might be changed by calling ttmbovalidate, move casting it to an i915tt object later to actually get the right pointer. A user reported hitting the following...

PT-2026-61201

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A Use-After-Free UAF issue exists in the drm/i915 component. The problem occurs during TTM object purge when the bo-ttm object is modified by the ttm bo validate function. This can lead ...

Linux Distros Unpatched Vulnerability : CVE-2026-52949

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/ttm: Fix ttmboshrink infinite LRU walk on backup failure Apply the same fix as b2ed01e7ad drm/ttm: Fix ttmboswapout infinite LRU walk on swapout failure to...

Linux Distros Unpatched Vulnerability : CVE-2026-52965

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/ttm: Fix ttmboswapout infinite LRU walk on swapout failure When ttmttswapout fails, the current code calls ttmresourceaddbulkmove followed by...

SUSE CVE-2026-52949

In the Linux kernel, the following vulnerability has been resolved: drm/ttm: Fix ttmboshrink infinite LRU walk on backup failure Apply the same fix as b2ed01e7ad "drm/ttm: Fix ttmboswapout infinite LRU walk on swapout failure" to the ttmboshrink path. Move delbulkmove from before the backup to...

SUSE CVE-2026-52965

In the Linux kernel, the following vulnerability has been resolved: drm/ttm: Fix ttmboswapout infinite LRU walk on swapout failure When ttmttswapout fails, the current code calls ttmresourceaddbulkmove followed by ttmresourcemovetolrutail to restore the resource's bulkmove membership. However,...

CVE-2026-52965

In the Linux kernel, the following vulnerability has been resolved: drm/ttm: Fix ttmboswapout infinite LRU walk on swapout failure When ttmttswapout fails, the current code calls ttmresourceaddbulkmove followed by ttmresourcemovetolrutail to restore the resource's bulkmove membership. However,...

CVE-2026-52949

In the Linux kernel, the following vulnerability has been resolved: drm/ttm: Fix ttmboshrink infinite LRU walk on backup failure Apply the same fix as b2ed01e7ad "drm/ttm: Fix ttmboswapout infinite LRU walk on swapout failure" to the ttmboshrink path. Move delbulkmove from before the backup to...

CVE-2026-52949

In the Linux kernel, the following vulnerability has been resolved: drm/ttm: Fix ttmboshrink infinite LRU walk on backup failure Apply the same fix as b2ed01e7ad "drm/ttm: Fix ttmboswapout infinite LRU walk on swapout failure" to the ttmboshrink path. Move delbulkmove from before the backup to...