Skip to main content

Linux Kernel EUVDEUVD-2026-45532

| CVE-2026-63848 HIGH
2026-07-19 Linux GHSA-hxpg-m7g6-848q
Information Disclosure Linux Suse
7.8
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.8 HIGH

Local DRM device access (AV:L, PR:L) with a simple crafted CS ioctl (AC:L, no UI); unsupported kernel fence write yields high memory-corruption impact across C/I/A.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 20, 2026 - 15:53 vuln.today
CVSS changed
Jul 20, 2026 - 15:22 NVD
7.8 (HIGH)
Patch available
Jul 19, 2026 - 16:19 EUVD
CVE Published
Jul 19, 2026 - 14:04 cve.org
HIGH 7.8
CVE Published
Jul 19, 2026 - 14:04 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu/jpeg: set no_user_fence for JPEG v2.0 ring

JPEG rings do not support 64-bit user fence writes, reject CS submissions with user fences.

(cherry picked from commit 96179da0c6b059eb31706a0abe8dd6381c533143)

AnalysisAI

Local privilege-context memory corruption/information disclosure in the Linux kernel's AMD GPU (amdgpu) JPEG v2.0 driver arises because JPEG rings do not support 64-bit user fence writes, yet command-submission (CS) requests carrying user fences were accepted. A local authenticated user with GPU/DRM access could submit crafted jobs that trigger unsupported user-fence writes, leading to high confidentiality, integrity, and availability impact (CVSS 7.8). This is a resolved kernel bug with an upstream stable fix; no public exploit has been identified and EPSS exploitation probability is low (0.17%, 7th percentile).

Technical ContextAI

The affected component is the amdgpu Direct Rendering Manager (DRM) subsystem, specifically the JPEG (JPEG Decode Engine) ring for the v2.0 IP block. GPU work is dispatched via command submission (CS) ioctls that place jobs on hardware rings; 'user fences' let userspace request a 64-bit fence value be written to a user-supplied address on job completion for synchronization. JPEG v2.0 rings physically cannot perform 64-bit user fence writes, so accepting CS submissions with user fences produces undefined/incorrect writes. The fix sets the ring's no_user_fence flag so the kernel rejects such submissions. The root cause is a missing capability/input validation before performing a hardware operation (conceptually CWE-20 Improper Input Validation / CWE-787-class out-of-bounds write behavior); the input CWE field is N/A, so this classification is inferred, not vendor-assigned.

RemediationAI

Apply the vendor-released stable kernel update for your branch: upgrade to 7.1, 7.0.10, 6.18.33, 6.12.91, or 6.6.141 (or later) as appropriate, which set no_user_fence on the JPEG v2.0 ring so user-fence CS submissions are rejected. The fix is delivered as stable-tree commits (https://git.kernel.org/stable/c/2e216c2ff159b2eb1da6e9c716d727efc73c64b5 and the related commits listed for other branches); distribution users should install the corresponding distro kernel package containing these backports. If immediate patching is not possible, reduce exposure by restricting local access to the DRM render/GPU device nodes (e.g., tighten /dev/dri/renderD* permissions and group membership) and avoid granting GPU access to untrusted local users or containers - the trade-off is that this can break legitimate GPU compute/decoding workloads for affected users. There is no configuration toggle to disable only JPEG user fences short of the code fix.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise Module for Basesystem 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Server for SAP Applications 15 SP7 Affected

Share

EUVD-2026-45532 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy