What is the CVSS score of CVE-2026-63855?

CVE-2026-63855 has a contested CVSS base score of 7.8 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Linux Kernel are affected by CVE-2026-63855?

A privilege escalation vulnerability in Linux kernel AMD GPU drivers (CVE-2026-63855) affects systems where users have GPU render-node access.. A patch is available.

How to fix or mitigate CVE-2026-63855?

Within 24 hours, inventory all systems with AMD GPUs and document current kernel versions. Within 7 days, obtain the vendor-released patch from your distribution maintainer (RHEL, Ubuntu, Fedora, or kernel.org), test it in a staging environment to verify amdgpu driver compatibility, and confirm GPU functionality. Within 30 days, deploy the patched kernel to all affected systems via your standard maintenance process, prioritizing systems where non-administrative users have GPU render-node access.

Linux Kernel CVE-2026-63855

EUVD-2026-45539 HIGH

2026-07-19 Linux

GHSA-rjvx-mc7h-2h7x

Information Disclosure Linux Red Hat

High

Disputed · 7.8 Vendor: Linux

Severity by source

Sources disagree (Low–High)

Vendor (Linux) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Local render-node access is required (AV:L, PR:L) with no user interaction and low complexity; an unchecked kernel fence write plausibly yields high confidentiality, integrity, and availability impact.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Red Hat

5.5 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Linux

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 20, 2026 - 15:56 vuln.today

CVSS changed

Jul 20, 2026 - 15:22 NVD

7.8 (HIGH)

Patch available

Jul 19, 2026 - 16:19 EUVD

CVE Published

Jul 19, 2026 - 14:04 cve.org

HIGH 7.8

CVE Published

Jul 19, 2026 - 14:04 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu/vcn: set no_user_fence for VCN v2.5 enc/dec rings

VCN encoder and decoder rings do not support 64-bit user fence writes, reject CS submissions with user fences.

(cherry picked from commit efc9dd5590894109bce9a0bfe1fa5592dd6b20b1)

AnalysisAI

Local privilege escalation and memory corruption in the Linux kernel amdgpu driver stems from VCN (Video Core Next) v2.5 encoder/decoder rings accepting command-stream submissions that request 64-bit user fence writes, an operation the hardware does not support. A local user with render-node access to an AMD GPU can submit a crafted CS with a user fence, causing the kernel to write to an unsupported/attacker-influenced fence address. No public exploit is identified at time of analysis; EPSS is low (0.16%, 5th percentile) and the flaw is not in CISA KEV.

Technical ContextAI

The affected component is the AMD GPU kernel driver (drm/amdgpu), specifically the VCN v2.5 block that handles hardware-accelerated video encode/decode. GPU command submission (CS) allows userspace to attach a 'user fence' - a memory address the GPU writes upon completion of work - but VCN 2.5 enc/dec rings lack support for 64-bit user fence writes. The upstream fix sets the ring's no_user_fence flag so the CS ioctl rejects submissions carrying user fences on these rings. Because the CPE data only identifies the product generically as 'linux:linux', the precise root-cause class is not tagged (CWE: N/A), but the pattern is a missing validation of a hardware capability leading to an unchecked/out-of-bounds fence write; the EUVD tag classifies the outcome as Information Disclosure.

RemediationAI

Apply the vendor-released patch by upgrading to a fixed stable kernel: 6.6.141, 6.12.91, 7.0.10, or 6.18.33 or later, per the corresponding kernel.org stable commits (e.g. https://git.kernel.org/stable/c/2c6fb056567efb49f8674108b86088a1cfaa86d0). The upstream fix sets no_user_fence on VCN 2.5 enc/dec rings so the CS submission path rejects user fences (cherry-picked from efc9dd5590894109bce9a0bfe1fa5592dd6b20b1). Where immediate kernel updates are not possible, reduce exposure by restricting access to the DRI render nodes (/dev/dri/renderD*) to trusted users/groups, which limits which local accounts can submit GPU command streams - with the trade-off that container workloads, multi-user desktops, and GPU compute/video pipelines relying on those users will lose GPU acceleration. There is no remote attack surface to firewall, so access control on the GPU device is the main compensating control.

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0	Not-Affected

CVE-2026-63855 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-63855

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code