18
CVEs
0
Critical
7
High
0
KEV
0
PoC
0
Unpatched C/H
100.0%
Patch Rate
0.2%
Avg EPSS
Severity Breakdown
CRITICAL
0
HIGH
7
MEDIUM
0
LOW
0
Monthly CVE Trend
Affected Products (30)
Linux Kernel
193
Debian Linux
40
Epyc 7443P Firmware
39
Epyc 7713 Firmware
39
Epyc 72F3 Firmware
39
Epyc 7443 Firmware
39
Epyc 74F3 Firmware
39
Epyc 7343 Firmware
39
Epyc 7763 Firmware
39
Epyc 7543 Firmware
39
Epyc 7643 Firmware
39
Epyc 7413 Firmware
39
Epyc 7543P Firmware
39
Epyc 75F3 Firmware
39
Epyc 7513 Firmware
39
Epyc 7713P Firmware
39
Epyc 7663 Firmware
39
Epyc 7313 Firmware
39
Epyc 7313P Firmware
39
Epyc 7453 Firmware
38
Epyc 73F3 Firmware
38
Epyc 7452 Firmware
32
Epyc 7272 Firmware
32
Epyc 7262 Firmware
32
Epyc 7542 Firmware
32
Epyc 7302P Firmware
32
Epyc 7352 Firmware
32
Epyc 7702 Firmware
32
Epyc 7532 Firmware
32
Epyc 7502P Firmware
32
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-74674 | Incorrect TLB flush address targeting in the Linux kernel's zap_pte_range memory management function exposes systems running kernel versions prior to 7.1.9 and 7.2 to local privilege escalation and information disclosure, particularly on AMD systems with EFER.TCE enabled and Intel systems using INVPCID. A low-privileged local attacker can exploit a race where the kernel flushes the wrong virtual address after freeing a page table, leaving stale CPU paging-structure-cache entries that can be speculatively accessed or cause the freed table to be reused with potentially attacker-controlled data. No public exploit code or active exploitation (CISA KEV) has been confirmed at time of analysis, and the 0.20% EPSS score reflects the complexity of reliable exploitation. | HIGH | 7.8 | 0.2% | 39 |
|
| CVE-2026-81015 | Incomplete error-path cleanup in the AMD PMC driver (`platform/x86/amd/pmc`) corrupts the kernel's global LPS0 s2idle linked list when `amd_stb_s2d_init()` fails during module probe, leaving a dangling registered handler whose backing `devm`-managed memory has been freed. On AMD-based x86 Linux systems running an affected kernel, this causes a kernel BUG (`list_add corruption`) upon module reload and a use-after-free condition on any subsequent suspend-to-idle (s2idle) transition. No public exploit exists and EPSS is 0.20% (10th percentile), but the failure condition can arise naturally on long-running systems or specific SMU firmware, making this a realistic local denial-of-service and a potential kernel code-execution path on vulnerable AMD hardware. | HIGH | 7.8 | 0.2% | 39 |
|
| CVE-2026-80680 | Use-after-free in the Linux kernel's AMD MP2 I2C driver (i2c-amd-mp2) enables local low-privileged users to corrupt kernel memory, potentially achieving privilege escalation or system crash on AMD hardware. The flaw occurs during driver probe: when i2c_add_adapter() fails, devres frees the platform I2C context, but the MP2 PCI driver retains a stale pointer in its IRQ and system-sleep callback table, allowing subsequent dereference of freed memory. No public exploit exists and EPSS is 0.18% (7th percentile), reflecting the hardware-specific and error-path-dependent nature of this flaw; vendor-released patches are available across all major stable kernel branches. | HIGH | 7.8 | 0.2% | 39 |
|
| CVE-2026-89808 | Linux kernel AMD KFD (amdkfd) SVM migration code can use an uninitialized return value when migrating a VM range whose CPU side is a hole, causing the driver to tear down all VRAM pages it has just allocated and leaving memory state inconsistent. Affected are Linux kernel builds using the AMD GPU compute path (SVM/HMM migration to VRAM on ROCm/HSA-capable AMD hardware); the flaw affects code reachable from the commit 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 baseline and is fixed in 6.18.51, 7.2.5 and 7.3-rc1. Triggering requires a local user holding a GPU device handle and hitting a racy, non-default memory-layout condition, and no public exploit code was identified at time of analysis; the vendor's CVSS 3.1 score of 7.8 is assessed as overstated relative to this local, condition-gated error-handling defect. | HIGH | 7.8 | – | 39 |
|
| CVE-2026-89819 | Missing validation of the plane degamma LUT size in the Linux kernel's AMD display driver (amdgpu/DC) lets a local, authenticated user who can submit DRM atomic commits supply a malformed AMD_PLANE_DEGAMMA_LUT blob - for example a single-entry LUT - and drive the kernel into a divide-by-zero in __is_lut_linear() or an out-of-bounds read in __drm_lut_to_dc_gamma(). The practical consequence is a kernel crash or denial of service and, via the out-of-bounds read, potential disclosure of kernel memory contents; there is no evidence of memory corruption leading to code execution, and this is a local-only issue. Reachability is narrow: the vulnerable property is exposed only on kernels built with AMD_PRIVATE_COLOR (not enabled in mainstream distribution kernels) and only on systems with an AMD GPU using the amdgpu/DC display path. No public exploit code and no confirmed active exploitation were identified at time of analysis, and vendor patches are available in the stable trees (6.12.110, 6.18.51, 7.2.5) and in mainline 7.3-rc1. | HIGH | 7.8 | – | 39 |
|
| CVE-2026-81016 | Uninitialized physical address use in the AMD PMC driver (`amd_stb_s2d_init()`) causes the Linux kernel to call `devm_ioremap()` with physical address zero when the SMU rejects a command with error 0xff, mapping the first 16 MB of physical RAM into kernel virtual address space. Affected systems are AMD-based Linux hosts where the System Management Unit returns an error during S2D (System Trace Buffer) initialization at driver probe time. No public exploit exists and EPSS is 0.20%, consistent with the hardware-gated trigger; fixes are available in Linux 6.18.50 and 7.2.4 stable branches. | HIGH | 7.7 | 0.2% | 39 |
|
| CVE-2026-89818 | Integer overflow in the Linux kernel's amdgpu VCN decode-message parser lets an authenticated local user with access to the AMD GPU device node bypass a buffer-count bounds check and drive the parser loop far past the end of a message buffer object, producing out-of-bounds kernel reads that crash the system (availability) and can disclose kernel memory (confidentiality). Exploitation is not remote or unauthenticated: the attacker must be a local principal able to submit VCN decode messages and must additionally allocate a roughly 4 GiB GPU-accessible mapping so msg[1] passes the earlier 'header does not fit in BO' check, a substantial resource precondition that our assessment scores as high attack complexity (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H). No public exploit code was identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV); this is a genuine but modest-priority local vulnerability. | HIGH | 7.1 | – | 36 |
|
| CVE-2026-74732 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Check for tg ops in dce110_set_avmute Some older DCE timing gen | – | 0.2% | 0 |
|
|
| CVE-2026-80704 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: use proper context for logging The same as the rest of the code | – | 0.2% | 0 |
|
|
| CVE-2026-80542 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix NULL pointer dereference in amdgpu_dm_crtc_set_vblank() amd | – | 0.2% | – |
|
|
| CVE-2026-80602 | In the Linux kernel, the following vulnerability has been resolved: perf/x86/amd/lbr: Fix kernel address leakage A user-only branch stack can contai | – | 0.2% | – |
|
|
| CVE-2026-80705 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: check if dml21_add_phantom_plane() is successful Verify that th | – | 0.1% | – |
|
|
| CVE-2026-89773 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Skip Update HDCP Config In Transition State Transition state do | – | 0.2% | – |
|
|
| CVE-2026-89453 | In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Put PCI device after handling PPR faults iommu_call_iopf_notifier() l | – | 0.2% | – |
|
|
| CVE-2026-89820 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: fix dc_lock leak on GPU reset error paths On GPU reset, dm_susp | – | – | – |
|