Linux Kernel CVE-2026-63879

Exploitation requires local access to a system running a vulnerable Linux kernel with the amdgpu driver loaded and an AMD GPU (or amdgpu-backed device) exposed to the attacker, plus permission to open the DRM render / KFD compute devices (/dev/dri/render*, /dev/kfd) to submit HMM/userptr GPU work - this is the concrete prerequisite implied by the amdgpu_hmm_range_get_pages code path. The CVSS PR:L confirms some (low) privilege/authentication is needed rather than pure remote-unauthenticated access, and UI:N means no victim interaction is required. Limiting factors: the attacker must trigger a concurrent MMU page-table change to win a narrow race window (a timing-dependent condition that reduces reliability despite AC:L), the target must actually have AMD GPU hardware and the amdgpu module in use, and hosts without GPU exposure to untrusted users are effectively out of scope.

Signals are largely consistent and point to a genuine but access-gated local risk. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates a local, low-complexity, low-privilege attack with high confidentiality, integrity, and availability impact - a strong local-EoP/info-leak profile requiring only a normal user with access to the render/DRM device. EPSS is low at 0.20% (10th percentile) and no POC is known, which is expected for a race condition that must win a narrow timing window; automation is possible but reliable exploitation is non-trivial. The vulnerability is NOT in CISA KEV and there is no evidence of active exploitation. The 'Information Disclosure' tag under-states the rated impact - CVSS asserts high integrity and availability impact (memory corruption / crash), not merely a leak - so treat the tag as one facet rather than the ceiling. No SSVC decision record or CWE was supplied; those gaps are noted rather than inferred as confirmed.

A local unprivileged user on a machine with an AMD GPU submits GPU work that maps user memory via HMM/userptr while concurrently manipulating the CPU page tables (e.g. via madvise/munmap/fork-driven migration) to win the notifier-sequence race. By forcing the driver to act on stale page references, the attacker reads freed kernel/other-process memory or corrupts kernel memory, potentially escalating privileges or crashing the host. No public POC is known, and the low-complexity but timing-dependent nature (AV:L/AC:L) means exploitation is feasible but requires reliably hitting the race window.