CVE-2026-68103

A flaw was found in the drm/amdgpu component of the Linux kernel. A local attacker could exploit a vulnerability where creating a user-queue with specific parameters overwrites an existing doorbell mapping. This could lead to misrouting of interrupt requests IRQs and incorrect cleanup processes,...

CVE-2026-68418

CVE-2026-68418 affects the Linux kernel RDMA/irdma path, specifically QP creation. The root cause was that iwqp->iwpbl could be dereferenced unconditionally later in irdma_setup_virt_qp if a user supplied req.user_wqe_bufs, even when it was zero. Although there was a NULL check, it only applie...

EUVD-2026-55338

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/userq: fix indefinite fence wait during GPU reset prereset only force-completes fences of MAPPED queues. A queue in any other state e.g. mid-eviction keeps its lastfence pending; after a GPU reset that fence never...

CVE-2026-68237

CVE-2026-68237 resolves an indefinite fence wait in drm/amdgpu/userq during a GPU reset. The pre_reset path only force-completes fences of MAPPED queues, leaving fences for queues in states like mid-eviction pending; after a reset, those fences may never signal, causing eviction/suspend workers a...

SUSE CVE-2026-52987

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: avoid double drmexecfini in userq validate When newaddition is true, amdgpuuserqvmvalidate calls drmexecfini&exec before iterating over the collected HMM ranges and calling amdgputtmttgetuserpages. If...

CVE-2026-53144 drm/amdkfd: fix NULL dereference in get_queue_ids()

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix NULL dereference in getqueueids When usrqueueidarray is NULL and numqueues is non-zero, getqueueids returns NULL. The callers check only ISERR on the return value; since ISERRNULL == false the check passes, and...

PT-2026-52240

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL dereference exists in the get queue ids function within the drm/amdkfd component. When the usr queue id array is NULL and num queues is non-zero, the function returns NULL. Becaus...

CVE-2026-52987

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: avoid double drmexecfini in userq validate When newaddition is true, amdgpuuserqvmvalidate calls drmexecfini before iterating over the collected HMM ranges and calling amdgputtmttgetuserpages. If amdgputtmttgetuserpag...

CVE-2026-52987 drm/amdgpu: avoid double drm_exec_fini() in userq validate

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: avoid double drmexecfini in userq validate When newaddition is true, amdgpuuserqvmvalidate calls drmexecfini&exec before iterating over the collected HMM ranges and calling amdgputtmttgetuserpages. If...

CVE-2026-52987

In the Linux kernel, CVE-2026-52987 arises from drm/amdgpu: double calls to drm_exec_fini() in userq_validate when new_addition is true. The code calls drm_exec_fini(&exec) before iterating HMM ranges and then, if amdgpu_ttm_tt_get_user_pages() fails, executes a second drm_exec_fini(&exec) on the...

PT-2026-51881

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A double free flaw exists in the drm/amdgpu component within the userq validate function. The issue occurs when amdgpu userq vm validate calls the drm exec fini function on an execution...

CVE-2026-46311 drm/amdgpu/userq: fix access to stale wptr mapping

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/userq: fix access to stale wptr mapping Use drmexec to take both locks i.e vm root bo and wptrobj bo to access the mapping data properly. This fixes the security issue of unmap the wptrobj while a queue creation is in...

CVE-2026-46311

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/userq: fix access to stale wptr mapping Use drmexec to take both locks i.e vm root bo and wptrobj bo to access the mapping data properly. This fixes the security issue of unmap the wptrobj while a queue creation is in...

CVE-2026-46311 drm/amdgpu/userq: fix access to stale wptr mapping

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/userq: fix access to stale wptr mapping Use drmexec to take both locks i.e vm root bo and wptrobj bo to access the mapping data properly. This fixes the security issue of unmap the wptrobj while a queue creation is in...

Linux kernel 安全漏洞

The Linux kernel is the core of the open-source operating system Linux, developed by the Linux Foundation in the United States. There is a security vulnerability in the Linux kernel, which stems from improper access to the wptr mapping in the drm amdgpu userq component, potentially leading to...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/userq: Fixed the issue of a reference leak during queue teardown in version 2. The user mode queue maintains a pointer to the most recent fence in userq-lastfence. This pointer retains an additional dmafence reference...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: The function validate doorbelloffset in user queue creation checks whether the doorbelloffset provided by the user is within the allowed range. The function amdgpuuserqgetdoorbellindex passes this value to...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Validated user queue size constraints. Added validation to ensure that user queue sizes meet hardware requirements: - The size must be a power of two for efficient ring buffer wrapping. - The size must be at least...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: RDMA/qedr: Fixed the qedrcreateuserqp error flow. Avoid the following warning by ensuring that allocated resources are freed in case qedrinituserqueue fails. ----------- Cut here --- WARNING: CPU: 0 PID: 143192 at...

CVE-2026-43400

A flaw was found in the Linux kernel's drm/amdgpu module. A local user could exploit this vulnerability by providing excessively large input values to the amdgpuuserqsignalioctl function. This lack of proper input validation can lead to an Out-Of-Memory OOM condition, causing a Denial of Service...