CVE-2026-89828

This CVE affects the Linux kernel's amdgpu DRM driver . The root cause is an initialization ordering bug in amdgpu_vram_mgr_init(): the function drmm_cgroup_register_region() is called before the list heads and buddy allocator are initialized. If it fails, the early return skips those initializat...

CVE-2026-89827

This Linux kernel vulnerability affects the drm/amdgpu driver's UVD (Unified Video Decoder) handling in SR-IOV VF contexts. The root cause is that uvd_v7_0_sw_init() does not initialize the UVD decode ring for a virtual function, yet amdgpu_uvd_resume() unconditionally force-completes that decode...

CVE-2026-89826

This vulnerability affects the Linux kernel 's drm/panthor GPU driver, specifically the panthor_fw_read_build_info() function. Two related flaws allow an out-of-bounds memory read: (1) the metadata range validation uses addition of two u32 fields (hdr.meta_start + hdr.meta_size), which can wrap a...

CVE-2026-89825

CVE-2026-89825 affects the drm/panthor driver in the Linux kernel. The functions panthor_init_cs_iface() and panthor_init_csg_iface() validate firmware control interface offsets using 32-bit arithmetic , which can wrap before the bounds check executes. Additionally, the validation uses the host w...

CVE-2026-89824

CVE-2026-89824 affects the Linux kernel component drm/panel-edp . The root cause is a failure to drop the i2c adapter reference on probe failure (e.g., probe deferral) and on driver unbind, specifically when a devicetree redundantly uses the 'ddc-i2c-bus' property to point to the aux ddc bus. Thi...

CVE-2026-89823

CVE-2026-89823 is a race condition in the Linux kernel's DRM subsystem . When drm_dev_register() partially fails (e.g., the render minor registers but the primary minor fails), the unplugged flag is never set. This allows userspace to enter a drm_dev_enter() critical section on the already-regist...

CVE-2026-89822

In the Linux kernel , the drm/i915 driver is vulnerable to a NULL pointer dereference in i915_pci_probe(). When a device is force-bound via the sysfs driver_override mechanism, pci_match_device() returns a dummy pci_device_id_any entry whose driver_data field is NULL. The probe function unconditi...

CVE-2026-89821

CVE-2026-89821 affects the Linux kernel DRM AMD display subsystem. The function __is_lut_linear() computes each LUT entry as i * MAX_DRM_LUT_VALUE / (size - 1). When called with a single-entry LUT , the divisor becomes zero, triggering a kernel divide error (#DE) . Since a LUT with fewer than two...

CVE-2026-89820

CVE-2026-89820 affects the Linux kernel 's drm/amd/display subsystem. On GPU reset, dm_suspend() acquires the dc_lock and defers its release to dm_resume(). If amdgpu_dm_commit_zero_streams() or dm_dmub_hw_init() fails, the error path returns without releasing the lock , causing every subsequent ...

CVE-2026-89819

CVE-2026-89819 is a Linux kernel vulnerability in the AMD display driver (drm/amd/display). The per-plane degamma LUT size was never validated before use, unlike the CRTC degamma path which is guarded by amdgpu_dm_verify_lut_sizes(). A malformed AMD_PLANE_DEGAMMA_LUT blob could trigger a divide-b...

CVE-2026-89818

CVE-2026-89818 is an integer overflow in the Linux kernel's drm/amdgpu/vcn driver, specifically in the dec_msg buffer count check. If the supplied msg[2] (num_buffers) is 0x3FFFFFFF, the expression 6 + num_buffers * 4 wraps to 2, causing the bounds check to pass and allowing the parser loop to re...

CVE-2026-89817

CVE-2026-89817 affects the Linux kernel DRM/GUD driver. The function gud_connector_add_tv_mode() reads fixed-size TV mode name buffers from a USB device and passes pointers to drm_mode_create_tv_properties_legacy(), which calls strlen() on each name. Because the device does not guarantee NUL-term...

CVE-2026-89816

CVE-2026-89816 is a memory leak in the Linux kernel's DRM (Direct Rendering Manager) subsystem. When DRM_MODE_PAGE_FLIP_EVENT is used, a drm_crtc_commit reference is not dropped if the event—allocated in prepare_signaling()—is set to NULL in complete_signaling(), preventing proper deallocation in...

CVE-2026-89815

CVE-2026-89815 affects the Linux kernel in the drm/ttm (Translation Table Manager) subsystem, specifically triggered via the Intel Xe GPU driver 's execution buffer path. The root cause is that ttm_pool_restore_and_alloc() fails to free and drop tt->restore after a successful restore commit, l...

CVE-2026-89814

CVE-2026-89814 is an out-of-bounds array index vulnerability in the Linux kernel 's drm/amdgpu driver. The adev->isolation[] array has one slot per partition, but a ring not assigned to a partition retains the AMDGPU_XCP_NO_PARTITION value (~0), causing an out-of-bounds access. This is trigger...

CVE-2026-89813

This vulnerability affects the Linux kernel drm/amdgpu driver. The KIQ ring (like the MES scheduler ring) sets no_scheduler = true and uses a polling fence, causing it to be skipped by the force-completion loop in amdgpu_device_pre_asic_reset(). Because its hardware fence value resides in wb (GTT...

CVE-2026-89812

This vulnerability affects the drm/amdgpu driver in the Linux kernel . The MES (Micro Engine Scheduler) scheduler ring uses no_scheduler = true, causing it to be skipped by the force-completion loop in amdgpu_device_pre_asic_reset(). Its polling fence hw value resides in wb (GTT) memory that surv...

CVE-2026-89811

CVE-2026-89811 affects the Linux kernel in the drm/amdkfd subsystem (AMD KFD driver). The MES (Micro Engine Scheduler) fails to perform a heavy-weight TLB invalidation after unmapping GPU queues—unlike HWS, which does so automatically. This creates a race condition where in-flight DMA descriptors...

CVE-2026-89810

CVE-2026-89810 affects the Linux kernel in the drm/amdkfd subsystem (AMD KFD driver). The root cause lies in the svm_migrate_copy_to_ram error path: when page migration from device to system RAM fails, the driver incorrectly used the DMA address (for adev) instead of the page PFN to release and u...

CVE-2026-89809

CVE-2026-89809 is a NULL pointer dereference in the Linux kernel's AMD KFD driver (drm/amdkfd). The bug is in the pqm_debugfs_mqds function: a for-loop calling mqd_mgr->debugfs_show_mqd() is incorrectly placed outside the if (pqn->q) block that initializes mqd_mgr. When a process holds a KF...