Skip to main content

Linux Kernel CVE-2026-63846

| EUVDEUVD-2026-45530 HIGH
2026-07-19 Linux GHSA-85mj-cvf7-w5v9
Information Disclosure Linux Suse
7.8
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.8 HIGH

Local user with GPU render-node access (AV:L, PR:L) submits a malformed fenced CS with no user interaction; unvalidated kernel-memory handling yields high C/I/A.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 20, 2026 - 15:51 vuln.today
CVSS changed
Jul 20, 2026 - 15:22 NVD
7.8 (HIGH)
Patch available
Jul 19, 2026 - 16:19 EUVD
CVE Published
Jul 19, 2026 - 14:04 cve.org
HIGH 7.8
CVE Published
Jul 19, 2026 - 14:04 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu/jpeg: set no_user_fence for JPEG v3.0 ring

JPEG rings do not support 64-bit user fence writes, reject CS submissions with user fences.

(cherry picked from commit 4d7d774f100efb5089c86a1fb8c5bf47c63fc9ef)

AnalysisAI

Local privilege escalation / memory-corruption risk in the Linux kernel's AMD GPU (amdgpu) JPEG v3.0 ring driver, where the ring was allowed to accept command-stream submissions containing 64-bit user fences that the JPEG hardware cannot actually write. The fix flags the JPEG v3.0 ring as no_user_fence and rejects such CS submissions, closing an unvalidated-write condition reachable by any local user with GPU device access. No public exploit identified at time of analysis; EPSS is low (0.17%) and this is not on CISA KEV.

Technical ContextAI

The affected subsystem is amdgpu, the mainline Linux kernel driver for AMD Radeon/Instinct GPUs, specifically its JPEG (JPEG decode/encode engine) v3.0 ring. GPU command submission (CS) lets userspace hand command buffers to hardware rings; a 'user fence' is a memory location the GPU writes on completion so userspace can poll for progress. JPEG rings do not implement 64-bit user-fence writes, yet the driver did not mark the ring with no_user_fence, so it accepted CS requests specifying user fences the engine could not correctly service. The upstream commit (cherry-picked from 4d7d774f) sets no_user_fence for the JPEG v3.0 ring and rejects fenced submissions. No CWE was assigned by NVD; the root cause is best characterized as improper validation of a hardware-capability constraint on a memory-write primitive (missing input/capability validation, CWE-20 class), which the vendor tags loosely as 'Information Disclosure.'

RemediationAI

Patch available per vendor advisory - upgrade to a fixed stable kernel for your branch (6.6.141, 6.12.91, 6.18.33, 7.0.10, or 7.1 or later per the ENISA EUVD data), or apply your distribution's backport of the commit that sets no_user_fence for the JPEG v3.0 ring (git.kernel.org/stable/c/ee035a9d3eed3a9f5a3e83c31a10b321c9598861 and the sibling stable commits). If you cannot patch immediately, the concrete compensating control is to restrict local access to the AMD GPU DRI/render devices - tighten permissions/ownership on /dev/dri/renderD* and /dev/dri/card* so only trusted users and services can submit GPU command streams; the trade-off is that GPU-accelerated workloads, containers, or compositors for restricted users will lose hardware acceleration. On multi-tenant or untrusted-user hosts, avoid exposing AMD GPU passthrough/JPEG engine access until patched. Cite and follow your distro's advisory for the exact backported package version rather than building from the raw commit.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise Module for Basesystem 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Server for SAP Applications 15 SP7 Affected

Share

CVE-2026-63846 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy