CVE-2026-89812

This vulnerability affects the drm/amdgpu driver in the Linux kernel . The MES (Micro Engine Scheduler) scheduler ring uses no_scheduler = true, causing it to be skipped by the force-completion loop in amdgpu_device_pre_asic_reset(). Its polling fence hw value resides in wb (GTT) memory that surv...

CVE-2026-89811

CVE-2026-89811 affects the Linux kernel in the drm/amdkfd subsystem (AMD KFD driver). The MES (Micro Engine Scheduler) fails to perform a heavy-weight TLB invalidation after unmapping GPU queues—unlike HWS, which does so automatically. This creates a race condition where in-flight DMA descriptors...

CVE-2026-89810

CVE-2026-89810 affects the Linux kernel in the drm/amdkfd subsystem (AMD KFD driver). The root cause lies in the svm_migrate_copy_to_ram error path: when page migration from device to system RAM fails, the driver incorrectly used the DMA address (for adev) instead of the page PFN to release and u...

CVE-2026-89809

CVE-2026-89809 is a NULL pointer dereference in the Linux kernel's AMD KFD driver (drm/amdkfd). The bug is in the pqm_debugfs_mqds function: a for-loop calling mqd_mgr->debugfs_show_mqd() is incorrectly placed outside the if (pqn->q) block that initializes mqd_mgr. When a process holds a KF...

CVE-2026-89808

CVE-2026-89808 affects the Linux kernel 's drm/amdkfd driver (AMD KFD). The root cause is an unhandled case in svm_migrate_copy_to_vram where the migration VM range is a hole on the CPU side (MIGRATE_PFN_MIGRATE set, MIGRATE_PFN_VALID unset). The driver still allocates device pages without a vali...

CVE-2026-89807

A NULL pointer dereference in the Linux kernel's drm/amdkfd driver allows a local user holding CAP_CHECKPOINT_RESTORE to panic the machine. Both create_queue_cpsch() and create_queue_nocpsch() call mqd_mgr->restore_mqd() unconditionally during CRIU restore, with no NULL guard. When restore_mqd...

CVE-2026-89806

CVE-2026-89806 affects the Linux kernel 's ofdrm driver within the drm/sysfb subsystem. The root cause is an integer overflow in the framebuffer size calculation fb_size = linebytes * height, where both operands are of type int. When both values are sufficiently large (e.g., 46341 × 46341 > IN...

CVE-2026-89805

CVE-2026-89805 affects the Linux kernel DRM pagemap subsystem, specifically drm_pagemap_migrate_populate_ram_pfn(). Two defects exist: (1) higher-order (THP) folio allocation under memory pressure lacked __GFP_NOWARN and had no fallback to order-0 allocations, causing kernel log spam and potentia...

CVE-2026-89804

CVE-2026-89804 affects the Linux kernel 's drm/nouveau/dmem subsystem, specifically the device-private THP (Transparent Huge Page) migration path. The root cause is a mismatched DMA unmap size : two teardown sites—nouveau_dmem_migrate_to_ram() (success path) and nouveau_dmem_migrate_copy_one() (c...

CVE-2026-89803

CVE-2026-89803 is a use-after-free in the Linux kernel's DRM/Nouveau driver. In nouveau_channel_del(), the fence context is destroyed before the channel-kill event subscription is dropped, leaving a narrow window where a kill event handler can dereference an already-freed fence context. The bug i...

CVE-2026-89802

CVE-2026-89802 is a NULL pointer dereference in the drm/nouveau/uvmm driver of the Linux kernel . When a NOUVEAU_VM_BIND job contains an OP_MAP_SPARSE operation that is processed successfully, op->ops remains NULL because the sparse-map path only creates a region without allocating ops. If a s...

CVE-2026-89801

CVE-2026-89801 is a vulnerability in the Linux kernel 's drm/nouveau/uvmm subsystem. The root cause is in nouveau_uvmm_bind_job_submit()'s OP_UNMAP_SPARSE handling: two failure paths (a -ENOENT busy-region check and a drm_gpuvm_sm_unmap_ops_create() failure) leave op->reg set, violating the do...

CVE-2026-89800

CVE-2026-89800 affects the drm/nouveau/uvmm component of the Linux kernel (NVIDIA Nouveau virtual unified memory management). The root cause is a missing cleanup during job unwinding: when a successful OP_UNMAP_SPARSE marks a region dirty and defers teardown, a subsequent failure in a later opera...

CVE-2026-89799

CVE-2026-89799 affects the Linux kernel BPF subsystem. The vulnerability exists in the bpf_get_stackid function, where the get_perf_callchain call requires preemption to be disabled both during the call and while accessing the returned trace entries buffer. Without this, a preemption event can le...

CVE-2026-89798

CVE-2026-89798 is a race condition in the Linux kernel's rpcrdma (RDMA) module. In rpcrdma_rn_register(), the notification object is inserted into the rd_xa xarray via xa_alloc() before the caller's callback is stored in rn->rn_done. Because notification objects are zero-allocated, a concurren...

CVE-2026-89797

CVE-2026-89797 is a use-after-free in the Linux kernel's power: supply: ab8500_fg driver. In ab8500_fg_remove(), the driver workqueue is destroyed while threaded interrupt handlers are still armed. Because those handlers are devm-managed and freed only after ->remove() returns, a handler that ...

CVE-2026-89796

CVE-2026-89796 affects the Linux kernel 's mm/damon/core subsystem. In kdamond_merge_regions() , if the maximum merge threshold exceeds UINT_MAX / 2 , doubling the threshold can overflow and bypass the loop-break condition, causing an infinite loop when the region count cannot be reduced below th...

CVE-2026-89795

CVE-2026-89795 affects the Linux kernel PCI hotplug driver on s390 systems that use a machine-level hypervisor. The root cause is that pci_create_slot() assigns a single shared pci_slot object to multifunction PCI devices; when a function is reset via the hotplug reset_slot() interface, the wrong...

CVE-2026-89794

CVE-2026-89794 affects the ksmbd (SMB server) component in the Linux kernel . The root cause lies in smb2_read_pipe(): compound response handling extends the last response iov to an eight-byte boundary, but the function allocates only the payload size. This mismatch means the alignment padding ca...

CVE-2026-92356

A resource consumption vulnerability exists in a2ui-project a2ui versions 0.9 and 0.9.1 , affecting the updateComponents function in the file basic_functions.ts (component: Update Components). A remote attacker with low privileges can trigger excessive resource consumption through a manipulation ...