What is the CVSS score of CVE-2026-63842?

CVE-2026-63842 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux are affected by CVE-2026-63842?

AMD's amdgpu JPEG v5.0.0 driver contains a local privilege escalation vulnerability allowing unprivileged users with GPU device access to escalate privileges and corrupt kernel memory.. A patch is available.

How to fix or mitigate CVE-2026-63842?

Within 24 hours, inventory all systems running the amdgpu driver through asset management systems and identify which host the vulnerable v5.0.0 version. Within 7 days, obtain the patched driver version from AMD security advisories and conduct compatibility testing in non-production environments. Within 30 days, systematically deploy the patched driver across all affected systems, prioritizing those where non-administrative users have GPU render node access, and verify successful deployment through kernel and driver logs.

Linux CVE-2026-63842

EUVD-2026-45526 HIGH

2026-07-19 Linux

GHSA-8794-5r5m-g546

Information Disclosure Linux Suse

7.8

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SUSE

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Red Hat

5.5 MEDIUM

qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 20, 2026 - 15:50 vuln.today

CVSS changed

Jul 20, 2026 - 15:22 NVD

7.8 (HIGH)

Patch available

Jul 19, 2026 - 16:19 EUVD

CVE Published

Jul 19, 2026 - 14:04 cve.org

HIGH 7.8

CVE Published

Jul 19, 2026 - 14:04 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu/jpeg: set no_user_fence for JPEG v5.0.0 ring

JPEG rings do not support 64-bit user fence writes, reject CS submissions with user fences.

(cherry picked from commit 0f43893d3cd478fa57836697525b338817c9c23d)

AnalysisAI

Local privilege escalation and memory corruption in the Linux kernel's amdgpu JPEG v5.0.0 driver allows a low-privileged local user with access to the GPU render node to submit command-stream (CS) requests carrying a 64-bit user fence that the JPEG ring cannot service, corrupting kernel/GPU-writable memory. The fix makes the driver set no_user_fence and reject such submissions. This is a CVSS 7.8 (AV:L) issue with a very low EPSS (0.17%, 6th percentile) and no public exploit identified at time of analysis; it is patched upstream.

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0	Not-Affected

CVE-2026-63842 vulnerability details – vuln.today

Back

Linux CVE-2026-63842

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code