Database/Kernel, userspace & hypervisor

Linux kernel and hypervisor vulnerabilities for GPU hosts

Host kernel, userspace, virtualization, and CPU microcode flaws that break the line between tenant and host: KVM, Xen, QEMU, VMware, and the kernel every GPU node boots.

1,169 entries135 critical48 known exploitedFilter and search this layer

2026605

202397

2025153

2024152

202286

202138

Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd): An out-of-bounds access in the amdkfd (KFD computeHighOct 1, 2025
Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amd/amdkfd): A correctness defect in the amdkfd (KFD computeHighMay 24, 2024
Linux KVM x86 - stack out-of-bounds in ioapic_write_indirect(): A guest write to the virtual IOAPIC causes a stackHighMay 21, 2024
Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd): A race condition or locking defect in the amdkfd (KFDMediumMay 21, 2024
Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd): A memory or reference-count leak in the amdkfd (KFDMediumMay 21, 2024
Linux KVM/SVM - missing sev_decommission in sev_receive_start: KVM failed to DECOMMISSION the current SEV contextMediumMay 21, 2024
Linux kernel mlx5_core kTLS RX offload: TLS RX resync list corruption: entries are moved by the resync handlerCriticalApr 10, 2024
Linux kernel mlx5_core representor TC path + net/sched tc extension: The TC_SKB_EXT skb extension is not zeroedHighMar 25, 2024
Linux kernel (eBPF): eBPF improper input validation leading to local privilege escalationHighAug 24, 2022
QEMU (virtio-net): Heap use-after-free in virtio_net_receive_rcu - guest-to-host code execution in the QEMU processHighMar 23, 2022
KVM (AMD SEV-ES): Out-of-bounds read/write in sev_es_string_io() - malicious SEV-ES guest corrupts host memoryHighFeb 18, 2022
polkit: Local privilege escalation via polkit_system_bus_name_get_creds_sync() raceHighFeb 16, 2022
polkit (pkexec): PwnKit: local privilege escalation to root via argv handlingHighJan 28, 2022
Linux kernel (af_packet): Double free in packet_set_ring(), local privilege escalationHighJan 26, 2022
Xen on AMD-Vi (AMD IOMMU) - ACPI IVMD unity-map page permissions: Xen honours ACPI-described IOMMU unity mappings butMediumAug 27, 2021
Xen on AMD-Vi - IOMMU page mapping permissions: Second of the XSA-378 IOMMU page-mapping issues on AMD-Vi. IncorrectMediumAug 27, 2021
Xen on AMD-Vi - IOMMU page mapping permissions: Third of the XSA-378 AMD-Vi mapping issues. Same practical consequenceMediumAug 27, 2021
Linux kernel (seq_file / fs layer): Sequoia: size_t-to-int conversion in the filesystem layer, local root on defaultHighJul 20, 2021
Linux kernel (netfilter x_tables): Heap out-of-bounds write in xt_compat_target_from_user()HighJul 7, 2021
Xen - x86 IOMMU command timeout detection and handling: Xen's IOMMU command timeout handling is inappropriate, so IOMMUHighJun 30, 2021
Xen on x86 - speculative vulnerabilities with bare 32-bit PV guests: Bare (non-shim) 32-bit PV guests run in ring 1, anMediumJun 11, 2021
Linux kernel (eBPF verifier): eBPF ALU32 bitwise-op bounds tracking flawHighJun 4, 2021
KVM: Improper handling of VM_IO/VM_PFNMAP vmas in KVM lets a guest bypass read-only checksHighMay 26, 2021
Microsoft Hyper-V: vmswitch fails to validate guest OID requestsCriticalMay 11, 2021
Linux kernel (overlayfs, Ubuntu patch): OverlayFS file-capability privilege escalationHighApr 17, 2021
VMware ESXi (OpenSLP): OpenSLP heap overflow - the ESXiArgs ransomware entry point that mass-encrypted thousandsHighFeb 24, 2021
sudo: Baron Samedit: heap overflow in sudo argument parsing, root from any local accountHighJan 26, 2021
Linux kernel (drivers/nvme/host): The NVMe/RDMA initiator destroys the queue pair before the connection manager ID, soCritical2021
Linux kernel (net/tls): KTLS stored a negative errno into the socket error field where a positive value is expected. ACritical2021
Linux kernel (net/smc): The early link-group cleanup path deletes the list head instead of the link group, so the groupCritical2021
Linux kernel (net/tls): When a NIC with active kTLS offload goes down, the offload teardown freed the TLS context whileHigh2021
Linux kernel (net/smc): The CDC send-completion handler takes a lock inside an smc_sock that close() has already freedHigh2021
Linux kernel (arch/x86/kvm/mmu): The TDP MMU skipped invalid roots when unmapping a GFN range, so KVM could still holdHigh2021
Linux kernel (drivers/nvme/target): When the target's peer-to-peer memory pool runs dry, it still tries to return theHigh2021
Linux kernel (arch/x86/kvm): A failed RSM leaves the vCPU's SMM flag and the MMU role out of sync, so KVM resolves aMedium2021
Linux kernel (arch/x86/kvm): The guard against accessing bytes 4-15 of an emulated APIC register was dropped, andMedium2021
Linux kernel (drivers/pci/hotplug): A power fault on a PCIe hotplug slot latches a sticky status bit that the hardirqMedium2021
Linux kernel (drivers/iommu/amd): On AMD hosts, switching a device's IOMMU group between a DMA domain and an identityMedium2021

20206

20195

20185

20171

Linux kernel (ELF loader): PIE stack buffer corruption, local rootHighOct 5, 2017

20166

20158

20141

Linux kernel KVM device assignment IOMMU path virt/kvm/iommu.c - kvm_iommu_map_pages: When an IOMMU mapping failsHigh2014

20134

20111

Xen PCI passthrough on Intel VT-d chipsets without interrupt remapping: The founding GPU-passthrough escape. A guestHigh2011

20101

Linux kernel RDS (Reliable Datagram Sockets) net/rds/page.c - rds_page_copy_user: Straight local-to-root. RDS - theHigh2010