Linux Kernel CVE-2026-63879

Patch is available from the vendor: update to a kernel that contains the fix commits, i.e. stable release 7.0.12 or 7.1 (or your distribution's kernel that backports commits 2fd24407457a6b181ba827705678da70e528dcd0 and 962d684b5dc0741dcd93485d41b450de402d5592). Apply the corresponding distribution kernel update and reboot, since the fix is in the running kernel image. Where immediate patching is not possible, the practical compensating control is to restrict access to AMD GPU compute/render features for untrusted local users - e.g. tighten permissions on /dev/dri/render* and /dev/kfd and limit which users/containers are granted GPU access - accepting that this will break GPU compute (ROCm/OpenCL/HMM) and hardware-accelerated workloads for those users; on hosts that do not need AMD GPU acceleration, not loading the amdgpu module removes the attack surface entirely. Reference the upstream commits above and the NVD advisory for version mapping.