56
CVEs
0
Critical
25
High
0
KEV
0
PoC
4
Unpatched C/H
87.5%
Patch Rate
0.2%
Avg EPSS
Severity Breakdown
CRITICAL
0
HIGH
25
MEDIUM
14
LOW
1
Monthly CVE Trend
Affected Products (30)
Linux Kernel
193
Debian Linux
40
Epyc 7443P Firmware
39
Epyc 7713 Firmware
39
Epyc 72F3 Firmware
39
Epyc 7443 Firmware
39
Epyc 74F3 Firmware
39
Epyc 7343 Firmware
39
Epyc 7763 Firmware
39
Epyc 7543 Firmware
39
Epyc 7643 Firmware
39
Epyc 7413 Firmware
39
Epyc 7543P Firmware
39
Epyc 75F3 Firmware
39
Epyc 7513 Firmware
39
Epyc 7713P Firmware
39
Epyc 7663 Firmware
39
Epyc 7313 Firmware
39
Epyc 7313P Firmware
39
Epyc 7453 Firmware
38
Epyc 73F3 Firmware
38
Epyc 7452 Firmware
32
Epyc 7272 Firmware
32
Epyc 7262 Firmware
32
Epyc 7542 Firmware
32
Epyc 7302P Firmware
32
Epyc 7352 Firmware
32
Epyc 7702 Firmware
32
Epyc 7532 Firmware
32
Epyc 7502P Firmware
32
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-68329 | Use-after-free in the Linux kernel AMD IOMMU driver allows a local low-privileged attacker on multi-CPU AMD systems to corrupt kernel memory by exploiting a logical race in `iommu_completion_wait()`. The `need_sync` flag was read locklessly, enabling a CPU to return without waiting for hardware IOMMU command completion while another CPU's page-table pages are freed - leaving the IOMMU walking stale, potentially freed memory. No public exploit exists and EPSS is 0.20% (10th percentile), but successful exploitation on AMD virtualization infrastructure could cross IOMMU isolation boundaries affecting co-tenant VMs. | HIGH | 8.8 | 0.2% | 44 |
|
| CVE-2026-53053 | Improper DMA-alias handling in the Linux kernel's AMD IOMMU driver lets a stale or incorrect Device Table Entry (DTE) be propagated to an alias PCI device, weakening the DMA isolation the IOMMU is meant to enforce. The flaw affects systems on AMD platforms where pci_for_each_dma_alias() supplies an alias-rather than the original-device to clone_alias(), causing the wrong source devid to be used when copying the DTE. EPSS is low (0.17%, 6th percentile) and there is no public exploit identified at time of analysis. | HIGH | 8.8 | 0.2% | 44 |
|
| CVE-2026-43606 | Timing side-channel in AMD Vitis Libraries' ECDSA secp256k1 Security Module exposes private cryptographic keys to local attackers via statistical analysis of operation timing or electromagnetic emanations. Affected are versions prior to 2026.1 of the Vitis Libraries Security Module and Vitis Unified Installer for FPGAs and Adaptive SoCs on Windows. AMD has released version 2026.1 as the fix; no public exploit or active exploitation has been identified at time of analysis. | HIGH | 8.5 | 0.1% | 43 |
No patch
|
| CVE-2026-74332 | Out-of-bounds array read in the Linux kernel's AMD ACP SoundWire SOF audio driver exposes kernel memory to local attackers on systems equipped with AMD SoundWire hardware. The flaw in create_sdw_dailinks() allows iteration past the end of the allocated sof_dais array when all entries are initialized, lacking any bounds guard on the loop termination condition. No active exploitation is recorded (EPSS 0.17%, 6th percentile; no CISA KEV entry), and patches are available across multiple Linux stable branches. | HIGH | 8.4 | 0.2% | 42 |
|
| CVE-2026-74333 | Out-of-bounds slab read in the Linux kernel's ASoC AMD ACP SoundWire legacy machine driver allows a local attacker - or a hardware-triggered probe path - to read beyond an allocated array in create_sdw_dailinks(), potentially causing kernel memory disclosure or denial of service. The vulnerability is introduced when all DAI link entries are initialized, causing the boundary-unchecked loop to walk past the end of the soc_dais allocation. KASAN confirmed the read-of-size-1 in mc_probe(). EPSS is at 0.17% (6th percentile) and the vulnerability is not listed in CISA KEV; no public exploit has been identified at time of analysis. Fixes are available for Linux stable branches 6.18.40 and 7.1.5, as well as the 7.2-rc1 mainline. | HIGH | 8.4 | 0.2% | 42 |
|
| CVE-2026-53137 | Out-of-bounds kernel heap write in the AMD Display (amdgpu) driver's HDMI HDCP 2.x repeater authentication path affects Linux kernels from 5.6 through the 7.1 release candidates. When reading a downstream sink's RxStatus register, the driver in mod_hdcp_read_rx_id_list() uses an attacker-influenced 10-bit message-size field (up to 1023 bytes) as the I2C read length without bounding it to the 177-byte rx_id_list buffer, so a malicious HDMI repeater can force a write past the buffer and corrupt kernel memory. There is no public exploit identified at time of analysis and EPSS is low (0.21%, 11th percentile); it is not listed in CISA KEV. | HIGH | 7.8 | 0.2% | 39 |
|
| CVE-2026-74674 | Incorrect TLB flush address targeting in the Linux kernel's zap_pte_range memory management function exposes systems running kernel versions prior to 7.1.9 and 7.2 to local privilege escalation and information disclosure, particularly on AMD systems with EFER.TCE enabled and Intel systems using INVPCID. A low-privileged local attacker can exploit a race where the kernel flushes the wrong virtual address after freeing a page table, leaving stale CPU paging-structure-cache entries that can be speculatively accessed or cause the freed table to be reused with potentially attacker-controlled data. No public exploit code or active exploitation (CISA KEV) has been confirmed at time of analysis, and the 0.20% EPSS score reflects the complexity of reliable exploitation. | HIGH | 7.8 | 0.2% | 39 |
|
| CVE-2026-81015 | Incomplete error-path cleanup in the AMD PMC driver (`platform/x86/amd/pmc`) corrupts the kernel's global LPS0 s2idle linked list when `amd_stb_s2d_init()` fails during module probe, leaving a dangling registered handler whose backing `devm`-managed memory has been freed. On AMD-based x86 Linux systems running an affected kernel, this causes a kernel BUG (`list_add corruption`) upon module reload and a use-after-free condition on any subsequent suspend-to-idle (s2idle) transition. No public exploit exists and EPSS is 0.20% (10th percentile), but the failure condition can arise naturally on long-running systems or specific SMU firmware, making this a realistic local denial-of-service and a potential kernel code-execution path on vulnerable AMD hardware. | HIGH | 7.8 | 0.2% | 39 |
|
| CVE-2026-80680 | Use-after-free in the Linux kernel's AMD MP2 I2C driver (i2c-amd-mp2) enables local low-privileged users to corrupt kernel memory, potentially achieving privilege escalation or system crash on AMD hardware. The flaw occurs during driver probe: when i2c_add_adapter() fails, devres frees the platform I2C context, but the MP2 PCI driver retains a stale pointer in its IRQ and system-sleep callback table, allowing subsequent dereference of freed memory. No public exploit exists and EPSS is 0.18% (7th percentile), reflecting the hardware-specific and error-path-dependent nature of this flaw; vendor-released patches are available across all major stable kernel branches. | HIGH | 7.8 | 0.2% | 39 |
|
| CVE-2026-53145 | Local privilege escalation and memory corruption in the Linux kernel DRM/GEM subsystem stems from a race condition in the GEM change_handle ioctl when it runs concurrently with gem_close, where botched two-stage idr_replace handling against the wrong idr slot allows a concurrent close to steal the object's only inherited reference. The flaw affects systems using the DRM graphics stack (notably AMD GPU paths, per source tags) and an unprivileged local user with access to a DRM render/card device can trigger a use-after-free, with the upstream resolution disabling the change_handle ioctl entirely until the locking can be proven correct. No public exploit identified at time of analysis and EPSS is low (0.17%, 7th percentile), consistent with a local-only, hard-to-win race rather than mass exploitation. | HIGH | 7.8 | 0.2% | 39 |
|
| CVE-2026-53136 | Out-of-bounds heap write in the Linux kernel amdgpu DRM display driver (drm/amd/display) arises because the VBIOS integrated info tables (v1_11 and v2_1) expose unvalidated u8 HdmiRegNum and Hdmi6GRegNum fields that are used as loop bounds when copying retimer I2C settings into fixed-size arrays (9 and 3 elements). A malformed VBIOS can set these counts up to 255, overrunning the destination arrays during driver probe on AMD GPU systems. No public exploit has been identified and EPSS is very low (0.17%), but the memory-corruption primitive (CWE-787) carries high confidentiality, integrity, and availability impact per the CVSS 7.8 rating. | HIGH | 7.8 | 0.2% | 39 |
|
| CVE-2026-64097 | Out-of-bounds read in the AMD display (amdgpu) driver of the Linux kernel occurs when the GPIO pin table parsers get_gpio_i2c_info() and bios_parser_get_gpio_pin_info() trust the VBIOS table_header.structuresize field and iterate over gpio_pin[] entries without confirming the full claimed size is mapped. On a system with a malformed or oversized VBIOS structuresize, the loop reads past the end of the BIOS image, potentially disclosing adjacent kernel memory or crashing the driver. There is no public exploit identified at time of analysis, EPSS is low (0.17%), and the issue is not listed in CISA KEV; a vendor patch is available across multiple stable trees. | HIGH | 7.8 | 0.2% | 39 |
|
| CVE-2026-68236 | Double-free and use-after-free conditions in the Linux kernel's drm/amd/display subsystem expose systems with AMD GPU hardware to potential privilege escalation or kernel crash. The flaw resides in dm_update_crtc_state(), where the skip_modeset path releases a display stream reference without nullifying the pointer, leaving it dangling for a second release if a subsequent error - such as a color management failure - triggers the fail label. Patches are confirmed across multiple stable branches (6.6.148, 6.12.101, 6.18.42, 7.1.6, and 7.2-rc4); no public exploit exists and EPSS sits at 0.17% (6th percentile), but the kernel-level memory corruption class demands prioritized patching on AMD GPU deployments. | HIGH | 7.8 | 0.2% | 39 |
|
| CVE-2026-74449 | Divide-by-zero panic in the Linux kernel's AMD display driver (drm/amd/display) allows a low-privileged local user to crash the kernel by triggering a zero-area viewport condition in the calculate_mcache_setting function. The vulnerable code path exits early with num_mcaches == 0 and mvmpg_width/height == 0, then proceeds to divide by those zero values, causing both a divide-by-zero panic and potential integer underflow on num_mcaches. EPSS is very low at 0.15% (5th percentile) and no active exploitation or public exploit code has been identified at time of analysis; however, the local trigger mechanism via display mode setting is accessible to low-privileged users on systems with AMD GPU hardware. | HIGH | 7.8 | 0.2% | 39 |
|
| CVE-2026-74450 | Use-after-free in the Linux kernel's AMD GPU power management subsystem (drm/amd/pm) allows a low-privileged local attacker to corrupt kernel memory via a race condition in the sysfs power table interface. The flaw exists because amdgpu_dpm_get_pp_table() returns a raw pointer to a driver-owned buffer after releasing adev->pm.mutex, enabling a concurrent pp_table write to free the allocation while a sysfs copy is still in progress. No public exploit has been identified and EPSS probability is very low (0.15%), but the CVSS 7.8 C:H/I:H/A:H impact reflects credible potential for local privilege escalation or kernel crash on AMD GPU-equipped Linux systems. | HIGH | 7.8 | 0.2% | 39 |
No patch
|