Skip to main content

Linux Kernel CVE-2026-53375

| EUVDEUVD-2026-45448 HIGH
2026-07-19 Linux GHSA-wxjr-mj69-3hfq
Information Disclosure Linux
8.8
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
8.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
vuln.today AI
8.7 HIGH

Local render-node access needed so AV:L/PR:L; malformed firmware address write yields memory corruption/DoS (I:H/A:H) crossing into firmware (S:C), but confidentiality impact is limited (C:L).

3.1 AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:L/SA:L
SUSE
7.3 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 20, 2026 - 18:02 vuln.today
CVSS changed
Jul 20, 2026 - 15:22 NVD
8.8 (HIGH)
Patch available
Jul 19, 2026 - 13:02 EUVD
CVE Published
Jul 19, 2026 - 10:01 cve.org
UNKNOWN (no severity yet)
CVE Published
Jul 19, 2026 - 10:01 cve.org
HIGH 8.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu/vce: Prevent partial address patches

In the case that only one of lo/hi is valid, the patching could result in a bad address written to in FW.

AnalysisAI

Local privilege escalation / memory corruption in the Linux kernel's amdgpu VCE (Video Compression Engine) driver allows an unprivileged local user with access to the AMD DRM render node to trigger a bad address being written into VCE firmware. The flaw stems from the command-buffer address-patching routine accepting a partially-valid relocation where only the low or high half of an address is present, producing a malformed pointer handed to firmware. No public exploit is identified at time of analysis (EPSS 0.16%, not in CISA KEV), and vendor stable-tree patches are available across all maintained branches.

Technical ContextAI

The vulnerability lives in the AMD GPU kernel driver (drm/amdgpu), specifically the VCE command-stream parser that validates and patches GPU virtual addresses embedded in user-submitted command buffers. VCE addresses are supplied as split 32-bit low/high (lo/hi) pairs that the driver relocates before the buffer is executed by firmware. When a submission contains only one half of the pair marked valid, the patching logic previously proceeded anyway, composing an incomplete/incorrect address that is then written into the firmware's execution context. The affected component is the mainline Linux kernel (CPE cpe:2.3:a:linux:linux) on systems with AMD GPUs that expose the legacy VCE block. No CWE was assigned by the source, but the root cause maps to improper input validation (CWE-20) of the relocation table leading to an out-of-bounds / invalid pointer write in a privileged firmware context.

RemediationAI

Vendor-released patch: upgrade to a fixed stable kernel - 6.1.175, 6.6.140, 6.12.90, 6.18.32, 7.0.9, or mainline 7.1, or the corresponding vendor/distribution kernel that backports the fix. The fix commits are available at https://git.kernel.org/stable/c/2d66d1f5d8c0434e9a5ad21cc6eaf3a5e32141d5, https://git.kernel.org/stable/c/944db9cfa5373f67eb94621d4c2eee572c05fa3f, https://git.kernel.org/stable/c/0ee17150763962671f43a62ddf8f6ea1feaff438, https://git.kernel.org/stable/c/b3d1a0a45c4aec484fa2a5b060b611e3d3064470, https://git.kernel.org/stable/c/ea2c554e700b86a04534b4c24ece5844e8c5f07e and https://git.kernel.org/stable/c/de2a02cc28d6d5d37db07d00a9a684c754a5fd74; apply your distribution's update and reboot. Where immediate patching is not possible, the exploitation surface can be reduced by restricting access to the AMD DRM render nodes (/dev/dri/renderD*) to trusted users/groups only - the side effect is that unprivileged GPU compute/video acceleration for other local users breaks. On multi-user or VDI hosts, avoid granting untrusted accounts direct GPU access; on systems that do not need the legacy VCE video block, this control has minimal functional trade-off.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-53375 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy