What is the CVSS score of CVE-2026-63856?

CVE-2026-63856 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by CVE-2026-63856?

Organizations operating GPU-based infrastructure-including AI/ML platforms, scientific computing clusters, and media processing systems-face a privilege escalation risk in the Linux AMD GPU driver…. A patch is available.

How to fix or mitigate CVE-2026-63856?

Within 24 hours, inventory all systems running the Linux kernel with amdgpu Video Core Next (VCN) driver support, prioritizing GPU compute clusters and media processing infrastructure; consult your Linux distribution's security advisory for specific affected kernel versions. Within 7 days, obtain and test the available kernel security update in a staging environment to verify GPU workload functionality and compatibility, then create a patching plan for production systems. Within 30 days, deploy the patched kernel across all production systems running amdgpu VCN drivers, confirm via kernel version inventory, and validate GPU driver operation post-deployment.

Linux Kernel CVE-2026-63856

EUVD-2026-45540 HIGH

2026-07-19 Linux

GHSA-g8wx-jx25-gcm6

Information Disclosure Linux

7.8

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Local render-node access needed (AV:L, PR:L) with no user interaction; malformed hardware fence writes yield kernel memory corruption, so C/I/A all High.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 20, 2026 - 15:57 vuln.today

CVSS changed

Jul 20, 2026 - 15:22 NVD

7.8 (HIGH)

Patch available

Jul 19, 2026 - 16:19 EUVD

CVE Published

Jul 19, 2026 - 14:04 cve.org

HIGH 7.8

CVE Published

Jul 19, 2026 - 14:04 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu/vcn: set no_user_fence for VCN v2.0 enc/dec rings

VCN encoder and decoder rings do not support 64-bit user fence writes, reject CS submissions with user fences.

(cherry picked from commit e2b5499fca55f1a32960a311bbb62e35891eaf73)

AnalysisAI

Local privilege escalation and memory corruption in the Linux kernel's amdgpu VCN (Video Core Next) driver arises because VCN v2.0 encoder and decoder rings accept command-stream (CS) submissions carrying 64-bit user fence writes that the hardware does not actually support. A local user able to submit GPU work (via /dev/dri render nodes) can trigger the driver to perform unsupported fence writes, leading to high-impact confidentiality, integrity, and availability effects consistent with kernel memory corruption or information disclosure. There is no public exploit identified at time of analysis, EPSS is low (0.16%), and the issue is not on the CISA KEV list, so this is a locally-scoped hardening/correctness fix rather than a remotely exploitable emergency.

Technical ContextAI

The affected component is the AMD GPU (amdgpu) DRM kernel driver, specifically the VCN media engine used for hardware video encode/decode. GPU command submission uses fences to signal completion; a 'user fence' lets the ring write a completion value to a user-supplied memory address. VCN v2.0 enc/dec rings physically cannot perform 64-bit user fence writes, so honoring a user-fence request produces an incorrect/truncated write to a driver- or user-associated address. The fix sets the ring's no_user_fence property so the command scheduler rejects any CS submission that requests a user fence on these rings. CWE is not assigned in the input, but the behavior class is improper validation of a hardware capability leading to an out-of-bounds or malformed memory write (functionally CWE-787-style memory corruption); the CPE data identifies the affected product only as cpe:2.3:a:linux:linux, i.e. the mainline Linux kernel.

RemediationAI

Primary fix: update to a patched stable kernel - Vendor-released patch versions 6.6.141, 6.12.91, 6.18.33, 7.0.10, or 7.1 (or later within your series), which set no_user_fence on VCN v2.0 enc/dec rings so the scheduler rejects CS submissions requesting user fences. Apply the corresponding distribution kernel update that incorporates git.kernel.org stable commit f264019be80de79f84f464846451445923bffea0 (and its backports). If immediate patching is not possible, reduce exposure by restricting access to GPU render nodes: tighten permissions/ACLs on /dev/dri/renderD* so only trusted users and services can submit GPU work, and avoid granting untrusted local users or containers direct GPU access - the trade-off is that GPU-accelerated video encode/decode and compute for those users will be unavailable. Verify fixes against your kernel series rather than assuming; the upstream commit hashes above are the source of truth (https://git.kernel.org/stable/c/f264019be80de79f84f464846451445923bffea0).

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0	Not-Affected

CVE-2026-63856 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-63856

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code