CVE-2026-74449
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix…
- Risk score
- 62/100
- CVSS
- 7.8 v3.1
- Exploit chance (30 days)
- 0.1%
- Published
- 15 Aug 2026
Open in the live forecast Today's forecast
What to know
- What it is
- In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix divide-by-zero in calculate_mcache_setting on zero viewport If a plane reaches calculate_mcache_setting with a zero-area viewport, calculate_mcache_setting exits early with num_mcaches == 0 and mvmpg_width/height == 0. This will c…
- Affected
- Canonical Ubuntu Linux
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- No known exploitation
Story map
At a glance
Canonical Ubuntu Linux: Red, act today. A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and the root directive or access log format references the map's regex capture variables before referencing the map output variable. An unauthenticated attacker can exploit this vulnerability by sending crafted HTTP requests, causing a heap buffer overflow in the NGINX worker process leading to a restart, or potential…
The flaws
- CVE-2026-74449: In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix… (CVSS 7.8 · EPSS 0%)
- CVE-2026-93479: Heap buffer overflow can lead to remote code execution (CVSS 8.1 · EPSS 1%)
- CVE-2026-15176: Heap buffer overflow can lead to remote code execution (CVSS 8.1 · EPSS 1%)
- CVE-2026-97205: NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_core_module module (CVSS 8.1 · EPSS 1%)
The fix
Fix: Check the linked advisory for the concrete fix.
Who is exposed: {'products': ['NGINX Plus', 'NGINX Open Source'], 'packages': [], 'versions': []}
Where it stands
- No known exploitation
How it unfolded
- 26 Oct, Ubuntu security notices (official): USN-8955-1: nginx vulnerabilities
- 3 Nov, Ubuntu security notices (official): USN-8960-1: Linux kernel (OEM) vulnerabilities
- 3 Nov, Ubuntu security notices (official): USN-8959-1: Linux kernel vulnerabilities
Connects to
- Same weakness: Heap buffer overflow (CWE-122). 398 other warnings in 30 days
- Same product: Earlier Canonical Ubuntu Linux warnings. 96 in the last 90 days
Why it is Amber
- CVSS 7.8 high
- On your watchlist: linux kernel
- Named in a government or vendor bulletin
Government and vendor bulletins
References
- https://ubuntu.com/security/notices/USN-8959-1
- https://ubuntu.com/security/notices/USN-8960-1
- https://git.kernel.org/stable/c/1f93537881fd22712732a60ad12572a3fd40c0ec
- https://git.kernel.org/stable/c/23a541c31b45fa813b33269376f6bd53535429a8
- https://git.kernel.org/stable/c/70f5f4ddba0d2d89e77ec13b79cdcfbef33be0d9
- https://git.kernel.org/stable/c/f327e389c07cfc3a2f6ff54f6214e1a52d457edc
Original description
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix divide-by-zero in calculate_mcache_setting on zero viewport If a plane reaches calculate_mcache_setting with a zero-area viewport, calculate_mcache_setting exits early with num_mcaches == 0 and mvmpg_width/height == 0. This will cause a divide-by-zero panic and can also cause an underflow on num_mcaches. Fix this by changing calculate_mcache_setting to bool and adding guards after each calculate_mcache_row_bytes call. If num_mcaches or mvmpg_width/height is zero, return a false. Callers will propagate the failure as a rejected mode, which prevents the panic. (cherry picked from commit 29c0f7c655f47bcbd575ff75e58480df6ec3c9da)
Last activity 3 Nov 2026. Patch Forecast updates every hour.