Skip to main content

Linux Kernel CVE-2026-64516

| EUVDEUVD-2026-48860 HIGH
2026-07-25 Linux GHSA-q3hq-vwmg-m826
Privilege Escalation Linux
8.8
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
8.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
vuln.today AI
7.8 HIGH

AC:H reflects the requirement for legacy AMD VCE 1 hardware; all other metrics follow the described local driver OOB with kernel scope change.

3.1 AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
SUSE
HIGH
qualitative
Red Hat
7.0 MEDIUM
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

6
Metadata Corrected
Sep 16, 2026 - 09:40 vuln.today
tag: Information Disclosure replaced by Privilege Escalation
Analysis Generated
Jul 27, 2026 - 06:03 vuln.today
CVSS changed
Jul 27, 2026 - 05:22 NVD
8.8 (HIGH)
Patch available
Jul 25, 2026 - 11:18 EUVD
CVE Published
Jul 25, 2026 - 09:14 cve.org
UNKNOWN (no severity yet)
CVE Published
Jul 25, 2026 - 09:14 cve.org
HIGH 8.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu/vce1: Fix VCE 1 firmware size and offsets

The VCPU BO contains the actual FW at an offset, but it was not calculated into the VCPU BO size. Subtract this from the FW size to make sure there is no out of bounds access.

Make sure the stack and data offsets are aligned to the 32K TLB size.

Check that the FW microcode actually fits in the space that is reserved for it.

(cherry picked from commit c16fe59f622a080fc457a57b3e8f14c780699449)

AnalysisAI

Out-of-bounds access in the Linux kernel amdgpu VCE 1 driver allows a low-privileged local attacker on systems with older AMD GPU hardware to potentially corrupt kernel memory and escalate privileges. The drm/amdgpu/vce1 driver failed to account for the firmware offset when sizing the VCPU Buffer Object, omitted alignment of stack and data offsets to the 32K TLB boundary, and lacked bounds checks ensuring firmware microcode fits reserved space - creating conditions for OOB read/write in kernel space. No public exploit code exists and EPSS stands at 0.20%, placing this in the 10th percentile for exploitation probability despite the high CVSS score.

Technical ContextAI

The AMD VCE (Video Compression Engine) version 1 is a hardware video encode block present on older AMD Southern Islands and Sea Islands GPUs (roughly GCN 1.0/1.1 generation, circa 2011-2014). The amdgpu kernel driver (drm/amdgpu/vce1.c) allocates a VCPU Buffer Object (BO) to hold VCE firmware and maps it for the GPU microcontroller. The bug is threefold: (1) the BO size calculation omitted the firmware-start offset, making the allocation too small; (2) stack and data offsets into the BO were not aligned to the 32K TLB page size required by the hardware; (3) no check verified that firmware microcode actually fit within reserved space. Together these produce out-of-bounds kernel memory access (CWE-119/CWE-787 are applicable, though NVD reports CWE as N/A). Affected CPE is cpe:2.3:a:linux:linux:*. The fix (commit c16fe59f622a for upstream, ce0de178ef08 and 3e5a1d5bb2ff for stable branches) corrects all three issues.

RemediationAI

Upgrade to a patched kernel: Linux 6.19, 7.0.11, or 7.1 (or later). Stable-tree commits ce0de178ef08408f6ba8f2e9a13bf52fbe5852f4 and 3e5a1d5bb2ff061e64c7992f8e5404dfd4c2d0f3 contain the fix; these are available at git.kernel.org/stable. Ubuntu users should apply the packages from USN-8618-1 (https://ubuntu.com/security/notices/USN-8618-1). As a compensating control on systems that cannot immediately patch, blacklisting the amdgpu module (echo 'blacklist amdgpu' >> /etc/modprobe.d/amdgpu-blacklist.conf) prevents driver load entirely, though this disables GPU hardware acceleration as a side effect. Restricting /dev/dri/* access to the minimum required user set limits exposure on multi-user systems but does not eliminate the risk since the OOB may occur at driver initialization before user-space interaction.

Same technique Privilege Escalation

View all
CVE-2024-0012 CRITICAL POC
9.3
CVE-2025-47812 CRITICAL POC
10.0
CVE-2013-0422 CRITICAL POC
9.8
CVE-2013-0632 CRITICAL POC
9.8
CVE-2024-9474 MEDIUM POC
6.9
CVE-2017-5689 CRITICAL POC
9.8
CVE-2021-20021 CRITICAL POC
9.8
CVE-2017-12635 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-64516 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy