What is the CVSS score of CVE-2026-63849?

CVE-2026-63849 has a contested CVSS base score of 7.8 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Linux Kernel are affected by CVE-2026-63849?

The Linux kernel amdgpu VCN v5.0.1 driver contains a local privilege escalation and memory-safety flaw that could allow local users with GPU render-node access to corrupt kernel memory and disclose…. A patch is available.

How to fix or mitigate CVE-2026-63849?

Within 24 hours, inventory all systems running AMD amdgpu VCN driver and audit which local users possess GPU render-node access permissions; document findings for risk prioritization. Within 7 days, verify patch availability from your Linux distribution's stable branch for the affected kernel version and plan a validated deployment window. Within 30 days, deploy the patched kernel across all identified systems, prioritizing workloads handling sensitive data or environments with untrusted local users, and confirm driver version post-reboot.

Linux Kernel CVE-2026-63849

EUVD-2026-45533 HIGH

2026-07-19 Linux

GHSA-r2qg-mr7w-fwj6

Information Disclosure Linux Suse

High

Disputed · 7.8 Vendor: Linux

Severity by source

Sources disagree (Low–High)

Vendor (Linux) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Requires local render-node access (AV:L, PR:L) with no special complexity or interaction; GPU/kernel memory corruption plausibly yields high confidentiality, integrity, and availability impact within the same system (S:U).

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Red Hat

5.5 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Linux

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 20, 2026 - 15:53 vuln.today

CVSS changed

Jul 20, 2026 - 15:22 NVD

7.8 (HIGH)

Patch available

Jul 19, 2026 - 16:19 EUVD

CVE Published

Jul 19, 2026 - 14:04 cve.org

HIGH 7.8

CVE Published

Jul 19, 2026 - 14:04 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu/vcn: set no_user_fence for VCN v5.0.1 enc ring

VCN encoder and decoder rings do not support 64-bit user fence writes, reject CS submissions with user fences.

(cherry picked from commit e16be95a2c3ee712b142cb27d2dca0b461181359)

AnalysisAI

Local privilege/memory-safety flaw in the Linux kernel's amdgpu VCN (Video Core Next) v5.0.1 driver allows a local user with GPU render-node access to submit command-stream (CS) requests containing 64-bit user fences that the VCN encoder/decoder rings cannot handle, leading to high-impact corruption (CVSS 7.8, tagged Information Disclosure). No public exploit identified at time of analysis; EPSS is low (0.17%, 6th percentile). A vendor patch is available upstream in the kernel stable tree.

Technical ContextAI

The vulnerability lives in the AMD GPU DRM (Direct Rendering Manager) subsystem, specifically the VCN (Video Core Next) media engine at hardware revision v5.0.1. VCN provides hardware-accelerated video encode/decode via kernel ring buffers to which userspace submits command streams (CS) through the amdgpu ioctl interface. A 'user fence' is a mechanism where the GPU writes a completion value to a userspace-visible memory address. The VCN encode/decode rings on this ASIC do not support 64-bit user-fence writes; without the fix the kernel would accept such CS submissions and program the ring to perform an unsupported write, producing undefined GPU/DMA behavior. The fix sets the ring's no_user_fence flag so the kernel rejects CS submissions carrying user fences. No CWE was assigned; the class is best described as improper validation of a hardware-capability constraint on a memory-write primitive, with the intelligence tag pointing to information disclosure.

RemediationAI

Patch available per vendor advisory: update to a Linux stable kernel that includes the fix (backported to the 6.18.x series around 6.18.33 and to the 7.0.x/7.1 lines per EUVD data - confirm the exact tagged release for your branch, as the CVE references point to git.kernel.org stable commits rather than a single release). Apply the upstream fix via commits https://git.kernel.org/stable/c/081ef0e46c9cdd26c0db0ef721470393d36b6655, https://git.kernel.org/stable/c/5a4bffd67e94944ed3db26a959346cfb7fabaecd, and https://git.kernel.org/stable/c/8f4954722eab88e10c4ea0c0d3b1269c31421d3a, then reboot into the patched kernel. Where immediate patching is not possible, reduce exposure by restricting access to the DRI render nodes (/dev/dri/renderD*) to trusted users/groups and avoiding exposure of the GPU to untrusted containers or multi-tenant workloads; the trade-off is that unprivileged GPU/video-acceleration workloads for those users will be denied hardware access.

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0	Not-Affected

CVE-2026-63849 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-63849

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code