Skip to main content

Linux Kernel CVE-2026-63844

| EUVDEUVD-2026-45528 HIGH
2026-07-19 Linux GHSA-9x48-m72f-7f2w
Information Disclosure Linux Suse
High
Disputed · 7.8 Vendor: Linux
Share

Severity by source

Sources disagree (Low–High)
Vendor (Linux) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.8 HIGH

Local render-node access is needed (AV:L, PR:L), the user-fence trigger is straightforward (AC:L), and kernel memory corruption yields full C/I/A impact within an unchanged scope.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
5.5 LOW
qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 20, 2026 - 15:50 vuln.today
CVSS changed
Jul 20, 2026 - 15:22 NVD
7.8 (HIGH)
Patch available
Jul 19, 2026 - 16:19 EUVD
CVE Published
Jul 19, 2026 - 14:04 cve.org
HIGH 7.8
CVE Published
Jul 19, 2026 - 14:04 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0.3 ring

JPEG rings do not support 64-bit user fence writes, reject CS submissions with user fences.

(cherry picked from commit 2f6afc97d259d530f4f86c7743efbc573a8da927)

AnalysisAI

Local memory corruption in the Linux kernel's AMD GPU (amdgpu) JPEG v4.0.3 driver allows a user with GPU render-node access to escalate privileges or crash the system by submitting command-stream (CS) work with a 64-bit user fence, which the JPEG ring hardware cannot write correctly. The fix flags the ring with no_user_fence so the kernel rejects such submissions. EPSS is very low (0.17%, 6th percentile) and there is no public exploit identified at time of analysis, so this is a hardening/robustness fix rather than an urgent externally-exploited threat.

Technical ContextAI

The affected component is the amdgpu Direct Rendering Manager (DRM) driver in the Linux kernel, specifically the JPEG (video decode/encode) IP block version 4.0.3 found on newer AMD GPU/accelerator silicon (e.g. AMD Instinct/CDNA-class and related parts). GPU work is submitted through 'rings'; a 'user fence' lets userspace request a 64-bit completion value be written to a user-supplied address on ring completion. The JPEG v4.0.3 ring does not support 64-bit user-fence writes, so accepting such a CS submission produces an incorrect/unbounded fence write. The upstream fix sets the ring's no_user_fence property so the command submission path rejects user-fence requests on this ring. CWE was not assigned by the source (N/A), but the root cause is an out-of-bounds / incorrect memory write class (CWE-787-style) driven by unvalidated userspace fence parameters against unsupported hardware.

RemediationAI

Patch available per vendor advisory: update to a fixed Linux stable release - 6.6.141, 6.12.91, 6.18.33, 7.0.10, or 7.1 or later - via your distribution's kernel update channel, which is the primary and sufficient fix. The upstream commits are at https://git.kernel.org/stable/c/b884ff67d62ef514eee9d5f605c03101c8b6bc98, https://git.kernel.org/stable/c/d6bd2a5fd611ec9c8a2411f084cff2435c709608, https://git.kernel.org/stable/c/8549b3933038e68dc61cb934b9a54223dd244a78, https://git.kernel.org/stable/c/249fa7549736de1c8e327d7ca6b32fa148a40bd6 and https://git.kernel.org/stable/c/83e37c0987ca92f9e87789b46dd311dcf5a4a6c8. If immediate patching is impossible, the compensating control is to restrict access to the AMD GPU render/DRM device nodes (e.g. tighten membership of the 'render'/'video' groups and permissions on /dev/dri/render*), which prevents untrusted local users from submitting GPU command streams; the trade-off is that GPU-accelerated workloads and containers for those users will lose direct device access. On systems that do not use the AMD JPEG engine, this attack surface is not reachable.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise Module for Basesystem 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Server for SAP Applications 15 SP7 Affected

Share

CVE-2026-63844 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy