Skip to main content

Linux Kernel EUVDEUVD-2026-45529

| CVE-2026-63845 HIGH
2026-07-19 Linux GHSA-pvx7-4g2w-qq4j
Information Disclosure Linux Suse
High
Disputed · 7.8 Vendor: Linux
Share

Severity by source

Sources disagree (Low–High)
Vendor (Linux) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.3 HIGH

Local render-node access needs low privilege (PR:L, AV:L) and low complexity; impact is primarily corruption/DoS (I:H/A:H) with limited disclosure (C:L) given the fence-write nature.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
5.5 LOW
qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 20, 2026 - 15:52 vuln.today
CVSS changed
Jul 20, 2026 - 15:22 NVD
7.8 (HIGH)
Patch available
Jul 19, 2026 - 16:19 EUVD
CVE Published
Jul 19, 2026 - 14:04 cve.org
HIGH 7.8
CVE Published
Jul 19, 2026 - 14:04 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0 ring

JPEG rings do not support 64-bit user fence writes, reject CS submissions with user fences.

(cherry picked from commit 8d0cac9478a3f046279c657d6a2545de49ae675a)

AnalysisAI

Local memory-corruption/denial-of-service risk in the Linux kernel amdgpu JPEG v4.0 ring (drm/amdgpu/jpeg) arises because JPEG rings cannot perform 64-bit user-fence writes, yet command-stream (CS) submissions carrying user fences were accepted; the fix sets no_user_fence to reject them. A local user with access to the AMD GPU device can submit crafted CS jobs specifying a user fence, causing the ring to attempt a fence write it does not support. No public exploit has been identified and EPSS is low (0.17%, 7th percentile), but the CVSS 3.1 score is 7.8 with high confidentiality, integrity, and availability impact.

Technical ContextAI

The affected component is the AMD GPU DRM driver (amdgpu) in the Linux kernel, specifically the JPEG decode engine (JPEG IP block version 4.0) exposed through the kernel GPU scheduler and command-submission (CS) IOCTL path. User fences let userspace request the GPU ring to write a 64-bit completion value to a userspace-visible buffer when a job finishes, enabling efficient fence signaling without a kernel round-trip. The JPEG v4.0 ring hardware does not implement 64-bit user-fence writes, so honoring such a request on this ring produces an unsupported/malformed write. The corrective commit sets the ring no_user_fence flag so the CS validation path rejects submissions that include user fences. No CWE was assigned in the input, but the root-cause class is missing validation of a hardware capability constraint leading to an out-of-bounds or malformed write (improper input/state validation in a driver). CPE data identifies the product only generically as cpe:2.3:a:linux:linux:*, i.e., the mainline Linux kernel.

RemediationAI

Vendor-released patch: update to a fixed stable kernel - 6.6.141, 6.12.91, 6.18.33, 7.0.10, or 7.1 (or any later release on those branches) - which is the primary and recommended remediation. The fix corresponds to stable commits d4e0172a1b614373385e9b7111b580f8d2e0b98f, a676f16ea9a7df96d69f405afb6eb349571b3382, 6876d05b899102f4dfdb9ad560132126144c1c72, af4b458daa597dae707bf3f1f74745f5fc133ca2, and e7e90b5839aeb8805ec83bb4da610b8dab8e184d (see https://git.kernel.org/stable/c/6876d05b899102f4dfdb9ad560132126144c1c72 and the companion links, plus https://nvd.nist.gov/vuln/detail/CVE-2026-63845). Where immediate kernel updates are not feasible, compensating controls include restricting access to the GPU render/DRI device nodes (tighten /dev/dri/renderD* permissions and 'video'/'render' group membership so untrusted local accounts cannot submit command streams) - trade-off: this can break GPU-accelerated workloads, containers, and compositors for those users; and avoiding exposure of the AMD JPEG engine to untrusted tenants on shared or multi-user hosts. Because the flaw is local-only, there is no network port or endpoint to block.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise Module for Basesystem 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Server for SAP Applications 15 SP7 Affected

Share

EUVD-2026-45529 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy