What is the CVSS score of EUVD-2026-45534?

EUVD-2026-45534 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by EUVD-2026-45534?

The AMD GPU kernel driver contains a privilege escalation flaw affecting systems that grant standard users GPU render access, enabling them to corrupt kernel memory and gain administrative control.. A patch is available.

How to fix or mitigate EUVD-2026-45534?

Within 24 hours, identify systems running AMD amdgpu VCN drivers and audit who has access to render devices (/dev/dri/*). Within 7 days, apply the vendor-released patch for the AMD amdgpu driver, coordinating with system maintenance windows. Within 30 days, verify patch deployment across your fleet via driver version inventory and security scanning, and conduct user access reviews to ensure only authorized personnel retain render device access.

Linux Kernel EUVD-2026-45534

| CVE-2026-63850 HIGH

2026-07-19 Linux

GHSA-5p3j-xr69-vggh

Information Disclosure Linux Suse

7.8

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Local render-node access at low privilege (PR:L, AV:L) with no user interaction; malformed kernel fence write yields high confidentiality, integrity, and availability impact within the host scope.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Red Hat

5.5 MEDIUM

qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 20, 2026 - 15:54 vuln.today

CVSS changed

Jul 20, 2026 - 15:22 NVD

7.8 (HIGH)

Patch available

Jul 19, 2026 - 16:19 EUVD

CVE Published

Jul 19, 2026 - 14:04 cve.org

HIGH 7.8

CVE Published

Jul 19, 2026 - 14:04 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu/vcn: set no_user_fence for VCN v5.0.0 enc ring

VCN encoder and decoder rings do not support 64-bit user fence writes, reject CS submissions with user fences.

(cherry picked from commit 49b1fbbb5a071197ee71e2d70959b1cb29bdc317)

AnalysisAI

Local privilege escalation and memory corruption in the Linux kernel's AMD GPU (amdgpu) VCN v5.0.0 driver arises because the video encode/decode rings do not support 64-bit user fence writes, yet command-stream (CS) submissions carrying user fences were accepted. A local user with render/DRI device access could submit crafted GPU jobs whose user-fence writes land outside the intended target, corrupting kernel-managed memory. The fix rejects such submissions by setting no_user_fence for the affected ring. There is no public exploit identified at time of analysis, and EPSS exploitation probability is low (0.17%, 6th percentile).

Technical ContextAI

The affected component is the amdgpu Video Core Next (VCN) v5.0.0 engine in the Linux DRM subsystem, which handles hardware video encode/decode on modern AMD GPUs. GPU work is dispatched through command-submission (CS) rings; a 'user fence' lets userspace request the hardware write a 64-bit completion value to a userspace-supplied address. The VCN encode (and decode) rings on this generation physically cannot perform 64-bit user-fence writes, so honoring a user-fence request produces an incorrect/undersized write to a controllable location - a memory-safety defect (write-what-where / out-of-bounds write class; NVD lists CWE as N/A and the source tags it as Information Disclosure). The corrective commit sets the ring's no_user_fence flag so the kernel rejects any CS that includes a user fence.

RemediationAI

Vendor-released patch: upgrade to Linux stable 6.12.91, 6.18.33, or 7.0.10, or mainline 7.1 (or later) as appropriate for your kernel branch; the change sets no_user_fence on the VCN v5.0.0 encode ring so CS submissions with user fences are rejected. Apply via your distribution's kernel update channel and reboot. The relevant upstream commits are at https://git.kernel.org/stable/c/9f5a1459ecc3195282be617639d710b54779c9dc and the parallel stable backports listed in the references. If immediate patching is not possible, the practical compensating control is to restrict access to GPU render/DRI device nodes (/dev/dri/renderD*) to trusted users and services - for example tightening group membership or container device passthrough - which limits who can submit VCN command streams; the trade-off is that this can break unprivileged GPU-accelerated video encode/decode and compute workloads for affected users.

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0	Not-Affected

EUVD-2026-45534 vulnerability details – vuln.today

Back

Linux Kernel EUVD-2026-45534

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code