Skip to main content

Linux Kernel CVE-2026-63847

| EUVDEUVD-2026-45531 HIGH
Improper Input Validation (CWE-20)
2026-07-19 Linux GHSA-398f-rxhj-v666
Information Disclosure Linux
7.8
CVSS 3.1 · Vendor: Linux
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Obtain local low-privileged shell
  2. Delivery
    Open AMD DRM render node
  3. Exploit
    Craft CS request with 64-bit user fence
  4. Execution
    Submit to JPEG v2.5 ring
  5. Persist
    Trigger unsupported fence write
  6. Impact
    Corrupt kernel memory / leak data

Vulnerability Assessment

Weakness
CWE
CWE-20
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
Exploitation Conditions

Requires local access (AV:L) and existing low-privileged authentication (PR:L) on a system with an AMD GPU that exposes the JPEG v2.5 IP block, plus permission to open the DRM/render device node and issue command submissions. The specific trigger is a CS submission that carries a 64-bit user fence directed at a JPEG ring; on default unpatched kernels these were accepted rather than rejected. Limiting factors: no remote vector, no exploitation without the specific AMD JPEG 2.5 hardware present, and the attacker must already have local GPU access - so exposure is confined to multi-user or container hosts sharing AMD GPUs. No user interaction is required (UI:N).
Impact

The CVSS 3.1 vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H yields 7.8 (High) and describes a local, low-complexity attack by an already-authenticated low-privileged user with high impact to C/I/A - typical for a kernel-space memory-safety defect. Countervailing signals lower real-world urgency: EPSS is only 0.17% (6th percentile), the vulnerability is not on CISA KEV (no confirmed active exploitation), and no POC is referenced. Exploitation additionally requires AMD hardware with the JPEG v2.5 IP block present and accessible, further narrowing the exposed population. There is no SSVC decision data in the input. Note a scope consideration: kernel memory-corruption bugs can sometimes cross privilege boundaries, but the vendor marked scope Unchanged (S:U), and the 'Information Disclosure' tag hints leakage may be the more realistic outcome than full code execution - the C:H/I:H/A:H rating should be treated as worst-case pending confirmation. Overall this is a routine, patch-in-normal-cycle kernel hardening fix, not an emergency.
Exploit ScenarioDerived

A local, low-privileged user on a machine with an AMD GPU exposing the JPEG v2.5 engine opens the DRM render node and submits a crafted command-submission request that includes a 64-bit user fence the JPEG ring cannot handle. On an unpatched kernel the request is accepted instead of rejected, driving an unsupported fence-write path that corrupts kernel memory and could leak data or destabilize the system. No public POC is referenced, and the attack requires existing local access to GPU devices.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 20, 2026

Local privilege escalation potential in the Linux kernel's AMD GPU JPEG v2.5 driver (drm/amdgpu/jpeg) arises because JPEG rings do not support 64-bit user fence writes, yet command-submission (CS) requests carrying user fences were accepted rather than rejected. A local user with GPU access could submit crafted CS requests that trigger memory corruption impacting confidentiality, integrity, and availability. No public exploit identified at time of analysis, and EPSS exploitation probability is very low (0.17%, 6th percentile), consistent with a hardware-gated local kernel driver bug rather than a mass-exploited flaw.

RemediationAI

Apply your distribution's kernel update that includes this fix (upstream cherry-pick of commit 3216a7f4e2642bda5fd14f57586e835ae9202587); Patch available per vendor advisory, with fixed stable versions including 6.6.141, 6.12.91, 6.18.33, 7.0.10, and 7.1. Reference the stable commits at https://git.kernel.org/stable/c/63691e396105611173072ad548fc2b68831ecf23 (and the sibling commits 4d96e3cb, 3a96fee6, 694fe016, 79405e77) and track your distro's advisory for the backported package. As a compensating control until patched, restrict local access to GPU render/DRM device nodes (e.g., tighten permissions on /dev/dri/renderD* to trusted users/groups) since exploitation requires local GPU command submission; the trade-off is that unprivileged GPU compute or hardware-accelerated JPEG workloads for restricted users will break. There is no network-facing exposure to block.

Affected VersionsENISA

Linux patch: 7.1
Linux patch: 6.12.91
Linux patch: 7.0.10
Linux 14f43e8f88c57bbeaed3d05f13efab733f5e2338 <79405e774ede411c6b47ed41c651e40b92de64a2
Linux 14f43e8f88c57bbeaed3d05f13efab733f5e2338 <694fe016969c5e5a24b9e0ef7c1307eedec8ddf8
Linux 14f43e8f88c57bbeaed3d05f13efab733f5e2338 <3a96fee676fc0caf08f03ad915bec6fcd144d551
Linux patch: 0
Linux 14f43e8f88c57bbeaed3d05f13efab733f5e2338 <4d96e3cbfc66e4d66ea0096bde858e28ab62da00
Linux patch: 6.18.33
Linux 14f43e8f88c57bbeaed3d05f13efab733f5e2338 <63691e396105611173072ad548fc2b68831ecf23
Linux 5.6
Linux patch: 6.6.141

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The affected component is the Direct Rendering Manager (DRM) subsystem of the Linux kernel, specifically the amdgpu driver's JPEG (video/image decode) engine at IP version 2.5. GPU command submission uses ring buffers, and 'user fences' let userspace request the kernel write a 64-bit completion value to a user-supplied address when a job finishes. JPEG rings lack support for these 64-bit user-fence writes; the fix sets the ring's no_user_fence flag so that CS submissions containing user fences are rejected at validation time. Without that guard, an unsupported fence write path could be exercised. CWE is not assigned in the input, but the root cause is a missing-validation / improper-input-handling class defect in a hardware ring abstraction. The affected CPE is generically cpe:2.3:a:linux:linux, which does not narrow the specific kernel versions.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Linux) PRIMARY 7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI 7.8 HIGH

Local GPU access by an authenticated low-priv user (AV:L/PR:L), no interaction, and kernel memory corruption justifies high C/I/A with unchanged scope.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE 5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
CVSS changed
Jul 20, 2026 - 15:22 NVD
7.8 (HIGH)
Patch available
Jul 19, 2026 - 16:19 EUVD
CVE Published
Jul 19, 2026 - 14:04 cve.org
HIGH 7.8
CVE Published
Jul 19, 2026 - 14:04 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu/jpeg: set no_user_fence for JPEG v2.5 ring

JPEG rings do not support 64-bit user fence writes, reject CS submissions with user fences.

(cherry picked from commit 3216a7f4e2642bda5fd14f57586e835ae9202587)

Executive ViewAI

Why It Matters

AMD GPU driver vulnerability CVE-2026-63847 creates a local privilege escalation risk in Linux-based GPU computing environments, potentially compromising confidential workloads or system integrity. The impact is limited to organizations operating GPU-accelerated infrastructure with local access controls. Despite HIGH technical severity, no public exploit identified at time of analysis, and exploitation probability is negligible (0.2% EPSS), making this a manageable risk through timely patching.

Business Impact: Medium
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.2%
Top 94% exploitable
Prevalence
Ubiquitous
Linux kernel runs on a huge fraction of servers and devices
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Defer
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact
Medium

Priority Score

39
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +39
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Same weakness CWE-20 – Improper Input Validation

View all
CVE-2021-44228 CRITICAL POC
10.0
CVE-2024-3400 CRITICAL POC
10.0
CVE-2022-47966 CRITICAL POC
9.8
CVE-2023-22515 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2017-9791 CRITICAL POC
9.8
CVE-2017-15944 CRITICAL POC
9.8
CVE-2019-0604 CRITICAL POC
9.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise Module for Basesystem 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Server for SAP Applications 15 SP7 Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-63847 ADVISORY https://seclists.org/oss-sec/2026/q3/230 ADVISORY https://ubuntu.com/security/notices/USN-8574-1 ADVISORY https://vuldb.com/vuln/380163 REF https://git.kernel.org/stable/c/3a96fee676fc0caf08f03ad915bec6fcd144d551 REF https://git.kernel.org/stable/c/4d96e3cbfc66e4d66ea0096bde858e28ab62da00 REF https://git.kernel.org/stable/c/63691e396105611173072ad548fc2b68831ecf23 REF https://git.kernel.org/stable/c/694fe016969c5e5a24b9e0ef7c1307eedec8ddf8 REF https://git.kernel.org/stable/c/79405e774ede411c6b47ed41c651e40b92de64a2 REF https://git.kernel.org/stable/c/c9e367e6e630e1655184ca886a9290bfe8cb30a9

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy