What is the CVSS score of EUVD-2026-45538?

EUVD-2026-45538 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by EUVD-2026-45538?

A local privilege escalation vulnerability in the AMD GPU driver (VCN 3.0) affects Linux systems running kernels 5.9 and later, allowing authenticated users with GPU access to corrupt kernel memory…. A patch is available.

How to fix or mitigate EUVD-2026-45538?

Within 24 hours, query your asset inventory and Linux systems management tools to identify all servers and workstations running kernel 5.9 or later with AMD GPU hardware (VCN 3.0 support) and document affected systems by department and criticality. Within 7 days, apply the available vendor-released kernel patch from your Linux distribution provider to all identified systems, scheduling updates during maintenance windows and prioritizing production infrastructure. Within 30 days, verify deployment completion through automated system audits, re-scan to confirm patch application, and validate no systems remain unpatched or vulnerable.

Linux Kernel EUVD-2026-45538

| CVE-2026-63854 HIGH

2026-07-19 Linux

GHSA-3g9q-994v-2h99

Information Disclosure Linux

7.8

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Local attacker with render-node access (AV:L, PR:L) triggers kernel memory corruption with no user interaction, yielding high confidentiality, integrity, and availability impact.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 20, 2026 - 15:56 vuln.today

CVSS changed

Jul 20, 2026 - 15:22 NVD

7.8 (HIGH)

Patch available

Jul 19, 2026 - 16:19 EUVD

CVE Published

Jul 19, 2026 - 14:04 cve.org

HIGH 7.8

CVE Published

Jul 19, 2026 - 14:04 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu/vcn: set no_user_fence for VCN v3.0 enc/dec rings

VCN encoder and decoder rings do not support 64-bit user fence writes, reject CS submissions with user fences.

(cherry picked from commit 663bed3c7b8b9a7624b0d95d300ddae034ad0614)

AnalysisAI

Local privilege escalation and memory-corruption risk in the amdgpu driver's VCN (Video Core Next) v3.0 encoder/decoder rings allows an authenticated local user with GPU render-node access to submit command streams containing 64-bit user-fence writes that the hardware does not support, corrupting kernel memory. The fix marks these rings with no_user_fence so the kernel rejects any command submission carrying a user fence. This affects Linux kernels from 5.9 onward that ship the AMD VCN 3.0 support; there is no public exploit identified at time of analysis and EPSS exploitation probability is low at 0.16% (5th percentile).

Technical ContextAI

The vulnerability lives in AMD's amdgpu kernel graphics driver, specifically the Video Core Next (VCN) v3.0 block that provides hardware video encode/decode. GPU work is submitted via command submission (CS) ioctls that reference GPU rings; 'user fences' are a mechanism where the GPU writes a completion value to a user-supplied memory address so userspace can track job completion. The VCN 3.0 enc/dec rings physically cannot perform 64-bit user-fence writes, yet the driver previously accepted CS submissions requesting them, leading to undefined/out-of-bounds fence writes. The remediation (cherry-picked from upstream commit 663bed3c7b8b) sets the no_user_fence ring flag so the CS path rejects such submissions. The CWE is not assigned by NVD, but the class is improper validation of a hardware capability leading to memory corruption (broadly CWE-787 out-of-bounds write / CWE-20 improper input validation). Affected products per CPE are cpe:2.3:a:linux:linux, i.e., the mainline Linux kernel.

RemediationAI

Vendor-released patch: update to a fixed stable kernel - 6.6.141, 6.12.91, 6.18.33, 7.0.10, or 7.1 (or later) - matching your kernel series; the fixes are the stable cherry-picks of upstream commit 663bed3c7b8b (stable commits e74fc9c72c1b, 26c4f38529ac, 2d6525e7b250, b076e45e6f75, f1e5a6660d7c, referenced at https://git.kernel.org/stable/). Apply your distribution's kernel update and reboot; live patching is unlikely to cover a driver ring-flag change. If you cannot patch immediately, reduce exposure by restricting access to the AMD DRI render nodes (e.g., tighten permissions/group membership on /dev/dri/renderD* so only trusted users and services can submit GPU command streams), which limits who can reach the vulnerable CS path at the cost of breaking GPU acceleration for non-privileged users and containers; on servers that do not need AMD hardware video encode/decode you can also avoid loading/using the VCN paths. Consult vendor advisories at the kernel.org stable commits and the NVD/EUVD entries (EUVD-2026-45538) for series-specific fixed versions.

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0	Not-Affected

EUVD-2026-45538 vulnerability details – vuln.today

Back

Linux Kernel EUVD-2026-45538

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code