Skip to main content

Linux Kernel CVE-2026-63851

| EUVDEUVD-2026-45535 HIGH
2026-07-19 Linux GHSA-jcqr-j666-39jw
Information Disclosure Linux Suse
High
Disputed · 7.8 Vendor: Linux
Share

Severity by source

Sources disagree (Low–High)
Vendor (Linux) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.8 HIGH

Local DRM device access needed (AV:L, PR:L) with no user interaction; unsupported fence write corrupts kernel memory, yielding high C/I/A within an unchanged scope.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
5.5 LOW
qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 20, 2026 - 15:55 vuln.today
CVSS changed
Jul 20, 2026 - 15:22 NVD
7.8 (HIGH)
Patch available
Jul 19, 2026 - 16:19 EUVD
CVE Published
Jul 19, 2026 - 14:04 cve.org
HIGH 7.8
CVE Published
Jul 19, 2026 - 14:04 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu/vcn: set no_user_fence for VCN v4.0.5 enc ring

VCN encoder and decoder rings do not support 64-bit user fence writes, reject CS submissions with user fences.

(cherry picked from commit 084d94ac93707bdda07efb5cee786f632de4219b)

AnalysisAI

Local privilege escalation / memory corruption in the Linux kernel's AMD GPU driver (amdgpu VCN v4.0.5) allows an authenticated local user to submit command-stream (CS) requests carrying 64-bit user fences to VCN encoder/decoder rings that do not support them, corrupting kernel memory. The fix marks the affected rings with no_user_fence so the kernel rejects such submissions. No public exploit identified at time of analysis; EPSS is low (0.16%, 5th percentile) and the issue is not on CISA KEV, but CVSS scores high impact (7.8) due to full C/I/A compromise from a local unprivileged-to-low-privileged vector.

Technical ContextAI

The flaw lives in the Direct Rendering Manager (DRM) subsystem's amdgpu driver, specifically the Video Core Next (VCN) v4.0.5 video codec block used for hardware-accelerated H.264/H.265/AV1 encode and decode. Userspace submits work to the GPU through command streams (CS) via the DRM ioctl interface; a 'user fence' lets userspace request a 64-bit completion value be written back to a userspace address. The VCN encode (and decode) rings on this hardware generation cannot perform 64-bit user fence writes, so honoring such a request produces undefined ring/memory behavior. The upstream commit (cherry-picked from 084d94ac93707bdda07efb5cee786f632de4219b) sets the ring's no_user_fence flag, causing the CS path to reject fence-bearing submissions. No CWE was assigned upstream, but the root-cause class is improper validation of a hardware-capability constraint leading to out-of-bounds/invalid memory writes (CWE-787-style out-of-bounds write / CWE-20 improper input validation).

RemediationAI

Vendor-released patch: update to a fixed stable kernel - 6.12.91, 6.18.33, 7.0.10, or 7.1 (or later) depending on your branch, or apply the corresponding upstream commits (75091030f07b, 6d9a98c5ed65, 7f23b5c420b9, 589a254bf3e8 at https://git.kernel.org/stable/c/). Most users should simply take their distribution's kernel update once it incorporates these commits. If immediate patching is not possible, the practical compensating control is to restrict access to the GPU render/DRM device nodes (/dev/dri/renderD*, /dev/dri/card*) - for example by tightening group membership/permissions so only trusted users and services can submit GPU command streams; the trade-off is that this breaks hardware-accelerated video encode/decode and 3D acceleration for restricted users. On multi-tenant or untrusted-local-user hosts, avoid exposing the affected VCN device to guests/containers until patched.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise Module for Basesystem 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Server for SAP Applications 15 SP7 Affected

Share

CVE-2026-63851 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy