Skip to main content

Linux Kernel EUVDEUVD-2026-45527

| CVE-2026-63843 HIGH
2026-07-19 Linux GHSA-cm3g-53f9-759w
Information Disclosure Linux Suse
High
Disputed · 7.8 Vendor: Linux
Share

Severity by source

Sources disagree (Low–High)
Vendor (Linux) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.8 HIGH

Local low-privileged GPU command submission with no user interaction; unsupported 64-bit fence write can corrupt or leak kernel memory, giving high C/I/A within an unchanged scope.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
5.5 LOW
qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 20, 2026 - 15:49 vuln.today
CVSS changed
Jul 20, 2026 - 15:22 NVD
7.8 (HIGH)
Patch available
Jul 19, 2026 - 16:19 EUVD
CVE Published
Jul 19, 2026 - 14:04 cve.org
HIGH 7.8
CVE Published
Jul 19, 2026 - 14:04 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0.5 ring

JPEG rings do not support 64-bit user fence writes, reject CS submissions with user fences.

(cherry picked from commit f05d0a4f21fc720116d6e238f23308b199891058)

AnalysisAI

Improper user-fence handling in the Linux kernel's AMDGPU JPEG v4.0.5 driver allows a local, low-privileged user to submit GPU command-stream (CS) jobs with 64-bit user fences to a JPEG ring that only supports narrower fence writes, potentially corrupting or disclosing kernel/GPU memory. The fix sets the no_user_fence flag so the driver rejects such CS submissions outright. Rated CVSS 7.8 (local), with no public exploit identified at time of analysis, a low EPSS of 0.17% (6th percentile), and no CISA KEV listing - this is a hardware-specific hardening fix rather than a broadly exploited flaw.

Technical ContextAI

The issue lives in the amdgpu Direct Rendering Manager (DRM) subsystem, specifically the JPEG decode/encode engine ring on the v4.0.5 IP block found in certain AMD GPUs/APUs. GPU work is submitted via command streams that can request a 'user fence' - a signal written back to a user-supplied address on job completion. JPEG rings on this generation do not support 64-bit user fence writes; without the no_user_fence guard, the driver would accept and process fence requests the ring cannot safely service, leading to out-of-bounds or malformed writes. The upstream commit (cherry-picked from f05d0a4f21fc) marks the ring with no_user_fence so the CS ioctl path rejects fence-bearing submissions. No CWE was assigned in the source data, but the class is best described as improper input validation / out-of-bounds write in a kernel driver, consistent with the 'Information Disclosure' tag provided.

RemediationAI

Apply the vendor patch by upgrading to a fixed stable kernel - Vendor-released patch: 6.12.91, 6.18.33, 7.0.10, or 7.1 (or your distribution's backported equivalent) as listed in the EUVD data. The corresponding stable commits are available at git.kernel.org (424510b60d4698a75a6ff71acdd88b528f0f39af, f9bc5633b761cff200c428f61ed0df6212b1c721, b65b7f3f3c18f797f81a2af7c97e2079900ad6db, f26e3f7186cd6ecc93e6af102744d64c798dea7e); track NVD at https://nvd.nist.gov/vuln/detail/CVE-2026-63843. Where immediate patching is not possible, the practical compensating control is to restrict local access to GPU render nodes: limit membership of the 'render'/'video' groups and tighten permissions on /dev/dri/renderD* so untrusted local users cannot submit GPU command streams - the trade-off is that GPU-accelerated workloads (video decode, containers, rendering apps) for those users will break. Because exploitation requires local access, standard multi-tenant hygiene (no untrusted local shells, container/VM isolation of the render node) meaningfully reduces exposure until the kernel is updated.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise Module for Basesystem 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Server for SAP Applications 15 SP7 Affected

Share

EUVD-2026-45527 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy