11
CVEs
0
Critical
4
High
0
KEV
0
PoC
0
Unpatched C/H
100.0%
Patch Rate
0.2%
Avg EPSS
Severity Breakdown
CRITICAL
0
HIGH
4
MEDIUM
0
LOW
0
Monthly CVE Trend
Affected Products (30)
Linux Kernel
193
Debian Linux
40
Epyc 7443P Firmware
39
Epyc 7713 Firmware
39
Epyc 72F3 Firmware
39
Epyc 7443 Firmware
39
Epyc 74F3 Firmware
39
Epyc 7343 Firmware
39
Epyc 7763 Firmware
39
Epyc 7543 Firmware
39
Epyc 7643 Firmware
39
Epyc 7413 Firmware
39
Epyc 7543P Firmware
39
Epyc 75F3 Firmware
39
Epyc 7513 Firmware
39
Epyc 7713P Firmware
39
Epyc 7663 Firmware
39
Epyc 7313 Firmware
39
Epyc 7313P Firmware
39
Epyc 7453 Firmware
38
Epyc 73F3 Firmware
38
Epyc 7452 Firmware
32
Epyc 7272 Firmware
32
Epyc 7262 Firmware
32
Epyc 7542 Firmware
32
Epyc 7302P Firmware
32
Epyc 7352 Firmware
32
Epyc 7702 Firmware
32
Epyc 7532 Firmware
32
Epyc 7502P Firmware
32
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-74674 | Incorrect TLB flush address targeting in the Linux kernel's zap_pte_range memory management function exposes systems running kernel versions prior to 7.1.9 and 7.2 to local privilege escalation and information disclosure, particularly on AMD systems with EFER.TCE enabled and Intel systems using INVPCID. A low-privileged local attacker can exploit a race where the kernel flushes the wrong virtual address after freeing a page table, leaving stale CPU paging-structure-cache entries that can be speculatively accessed or cause the freed table to be reused with potentially attacker-controlled data. No public exploit code or active exploitation (CISA KEV) has been confirmed at time of analysis, and the 0.20% EPSS score reflects the complexity of reliable exploitation. | HIGH | 7.8 | 0.2% | 39 |
|
| CVE-2026-81015 | Incomplete error-path cleanup in the AMD PMC driver (`platform/x86/amd/pmc`) corrupts the kernel's global LPS0 s2idle linked list when `amd_stb_s2d_init()` fails during module probe, leaving a dangling registered handler whose backing `devm`-managed memory has been freed. On AMD-based x86 Linux systems running an affected kernel, this causes a kernel BUG (`list_add corruption`) upon module reload and a use-after-free condition on any subsequent suspend-to-idle (s2idle) transition. No public exploit exists and EPSS is 0.20% (10th percentile), but the failure condition can arise naturally on long-running systems or specific SMU firmware, making this a realistic local denial-of-service and a potential kernel code-execution path on vulnerable AMD hardware. | HIGH | 7.8 | 0.2% | 39 |
|
| CVE-2026-80680 | Use-after-free in the Linux kernel's AMD MP2 I2C driver (i2c-amd-mp2) enables local low-privileged users to corrupt kernel memory, potentially achieving privilege escalation or system crash on AMD hardware. The flaw occurs during driver probe: when i2c_add_adapter() fails, devres frees the platform I2C context, but the MP2 PCI driver retains a stale pointer in its IRQ and system-sleep callback table, allowing subsequent dereference of freed memory. No public exploit exists and EPSS is 0.18% (7th percentile), reflecting the hardware-specific and error-path-dependent nature of this flaw; vendor-released patches are available across all major stable kernel branches. | HIGH | 7.8 | 0.2% | 39 |
|
| CVE-2026-81016 | Uninitialized physical address use in the AMD PMC driver (`amd_stb_s2d_init()`) causes the Linux kernel to call `devm_ioremap()` with physical address zero when the SMU rejects a command with error 0xff, mapping the first 16 MB of physical RAM into kernel virtual address space. Affected systems are AMD-based Linux hosts where the System Management Unit returns an error during S2D (System Trace Buffer) initialization at driver probe time. No public exploit exists and EPSS is 0.20%, consistent with the hardware-gated trigger; fixes are available in Linux 6.18.50 and 7.2.4 stable branches. | HIGH | 7.7 | 0.2% | 39 |
|
| CVE-2026-74732 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Check for tg ops in dce110_set_avmute Some older DCE timing gen | – | 0.2% | 0 |
|
|
| CVE-2026-80704 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: use proper context for logging The same as the rest of the code | – | 0.2% | 0 |
|
|
| CVE-2026-80542 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix NULL pointer dereference in amdgpu_dm_crtc_set_vblank() amd | – | 0.2% | – |
|
|
| CVE-2026-80602 | In the Linux kernel, the following vulnerability has been resolved: perf/x86/amd/lbr: Fix kernel address leakage A user-only branch stack can contai | – | 0.2% | – |
|
|
| CVE-2026-80705 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: check if dml21_add_phantom_plane() is successful Verify that th | – | 0.1% | – |
|
|
| CVE-2026-89773 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Skip Update HDCP Config In Transition State Transition state do | – | 0.2% | – |
|
|
| CVE-2026-89453 | In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Put PCI device after handling PPR faults iommu_call_iopf_notifier() l | – | 0.2% | – |
|