What is the CVSS score of EUVD-2026-45539?

EUVD-2026-45539 has a contested CVSS base score of 7.8 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

How to fix or mitigate EUVD-2026-45539?

Within 24 hours, inventory all systems with AMD GPUs and document current kernel versions. Within 7 days, obtain the vendor-released patch from your distribution maintainer (RHEL, Ubuntu, Fedora, or kernel.org), test it in a staging environment to verify amdgpu driver compatibility, and confirm GPU functionality. Within 30 days, deploy the patched kernel to all affected systems via your standard maintenance process, prioritizing systems where non-administrative users have GPU render-node access.

Linux Kernel EUVD-2026-45539

Q: Which versions of Linux Kernel are affected by EUVD-2026-45539?

A privilege escalation vulnerability in Linux kernel AMD GPU drivers (CVE-2026-63855) affects systems where users have GPU render-node access.. A patch is available.

| CVE-2026-63855 HIGH

Improper Input Validation (CWE-20)

2026-07-19 Linux

GHSA-rjvx-mc7h-2h7x

Information Disclosure Linux

High

Disputed · 7.8 Vendor: Linux

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Gain local render-node access
Delivery

Open AMD GPU device
Exploit

Submit CS with user fence on VCN 2.5 ring
Execution

Trigger unsupported 64-bit fence write
Impact

Corrupt or disclose kernel memory

Vulnerability Assessment

Weakness	CWE CWE-20 OWASP Top 10:2025 A05:2025 - Injection ASVS 5.0 V2 - Validation and Business Logic Input validation, allowlisting
Exploitation Conditions	Exploitation requires local access to a machine running an unpatched Linux kernel with an AMD GPU that exposes VCN v2.5 encoder/decoder rings, plus the ability to open the GPU render node (/dev/dri/renderD*) and issue a command-stream submission carrying a 64-bit user fence - the exact trigger described. Limiting factors: the attacker must already have a local account or code execution (PR:L, AV:L), the specific AMD VCN 2.5 hardware/driver path must be present, and no network or remote vector exists; systems without an AMD GPU or without render-node access for the attacker are not exploitable.
Impact	The supplied CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, score 7.8) describes a local, low-complexity, low-privilege flaw with high confidentiality, integrity, and availability impact - consistent with a local user who can open the GPU render node. These signals point to real but bounded risk: exploitation requires local access and an AMD GPU with a VCN 2.5 block, which is why EPSS is low (0.16%, 5th percentile) and the CVE is absent from CISA KEV. There is tension worth noting: the vector claims high C/I/A impact, yet the EUVD tag labels this 'Information Disclosure' only - the true impact ceiling (leak vs. kernel memory corruption/escalation) is not independently confirmed and should be verified against the amdgpu commit. No SSVC decision or POC availability was provided. Overall this is a defense-in-depth kernel hardening fix rather than an urgent, remotely exploitable priority.
Exploit ScenarioDerived	A local, low-privileged user (or a compromised process/container with GPU render-node access) opens the AMD GPU device and issues a command-stream ioctl that attaches a 64-bit user fence to a VCN 2.5 encode or decode ring. On unpatched kernels the driver accepts the unsupported fence, causing an unchecked kernel-side fence write that can corrupt or disclose kernel memory. No public POC is currently identified, and the local, low-complexity vector means no user interaction is required.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 20, 2026

Local privilege escalation and memory corruption in the Linux kernel amdgpu driver stems from VCN (Video Core Next) v2.5 encoder/decoder rings accepting command-stream submissions that request 64-bit user fence writes, an operation the hardware does not support. A local user with render-node access to an AMD GPU can submit a crafted CS with a user fence, causing the kernel to write to an unsupported/attacker-influenced fence address. No public exploit is identified at time of analysis; EPSS is low (0.16%, 5th percentile) and the flaw is not in CISA KEV.

RemediationAI

Apply the vendor-released patch by upgrading to a fixed stable kernel: 6.6.141, 6.12.91, 7.0.10, or 6.18.33 or later, per the corresponding kernel.org stable commits (e.g. https://git.kernel.org/stable/c/2c6fb056567efb49f8674108b86088a1cfaa86d0). The upstream fix sets no_user_fence on VCN 2.5 enc/dec rings so the CS submission path rejects user fences (cherry-picked from efc9dd5590894109bce9a0bfe1fa5592dd6b20b1). Where immediate kernel updates are not possible, reduce exposure by restricting access to the DRI render nodes (/dev/dri/renderD*) to trusted users/groups, which limits which local accounts can submit GPU command streams - with the trade-off that container workloads, multi-user desktops, and GPU compute/video pipelines relying on those users will lose GPU acceleration. There is no remote attack surface to firewall, so access control on the GPU device is the main compensating control.

Affected VersionsENISA

Linux patch: 7.1

Linux 5.4

Linux 28c17d72072b7ce5cc13a527dcbfc045cc995e7d <2c6fb056567efb49f8674108b86088a1cfaa86d0

Linux patch: 6.6.141

Linux patch: 6.12.91

Linux patch: 7.0.10

Linux 28c17d72072b7ce5cc13a527dcbfc045cc995e7d <5a3c6f76cab164a5d803084908d7050f649ab7f9

Linux patch: 0

Linux 28c17d72072b7ce5cc13a527dcbfc045cc995e7d <4f317863a3ab212a027d8c8c3cc3af4e3fb95704

Linux 28c17d72072b7ce5cc13a527dcbfc045cc995e7d <8f0ea4524dc71c6c9ec97f2711f46e12f624140f

Linux 28c17d72072b7ce5cc13a527dcbfc045cc995e7d <602d4c5872b25ddd4d82fb2025efb9a05b187bb3

Linux patch: 6.18.33

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The affected component is the AMD GPU kernel driver (drm/amdgpu), specifically the VCN v2.5 block that handles hardware-accelerated video encode/decode. GPU command submission (CS) allows userspace to attach a 'user fence' - a memory address the GPU writes upon completion of work - but VCN 2.5 enc/dec rings lack support for 64-bit user fence writes. The upstream fix sets the ring's no_user_fence flag so the CS ioctl rejects submissions carrying user fences on these rings. Because the CPE data only identifies the product generically as 'linux:linux', the precise root-cause class is not tagged (CWE: N/A), but the pattern is a missing validation of a hardware capability leading to an unchecked/out-of-bounds fence write; the EUVD tag classifies the outcome as Information Disclosure.

Know when the next one hits your stack

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Sources disagree (Low–High)

Vendor (Linux) PRIMARY 7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI 7.8 HIGH

Local render-node access is required (AV:L, PR:L) with no user interaction and low complexity; an unchecked kernel fence write plausibly yields high confidentiality, integrity, and availability impact.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE 5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Red Hat 5.5 LOW

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Linux

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVSS changed

Jul 20, 2026 - 15:22 NVD

7.8 (HIGH)

Patch available

Jul 19, 2026 - 16:19 EUVD

CVE Published

Jul 19, 2026 - 14:04 cve.org

HIGH 7.8

CVE Published

Jul 19, 2026 - 14:04 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu/vcn: set no_user_fence for VCN v2.5 enc/dec rings

VCN encoder and decoder rings do not support 64-bit user fence writes, reject CS submissions with user fences.

(cherry picked from commit efc9dd5590894109bce9a0bfe1fa5592dd6b20b1)

Executive ViewAI

Why It Matters

A privilege escalation vulnerability in Linux kernel AMD GPU drivers (CVE-2026-63855) affects systems where users have GPU render-node access. No public exploit is identified at time of analysis, and the 0.2% exploitation probability indicates low near-term risk. A vendor patch is available, enabling organizations to address this local access control gap through standard kernel update cycles.

Business Impact: Medium

Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score

0.2%

Top 95% exploitable

Prevalence

High

Linux kernel is ubiquitous, but this path needs an AMD VCN 2.5 GPU

Data Quality

5 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS Vendor

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.2%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Defer

Exploitation· derived

None

System Exposure· derived

Small

Automatable· derived

Human Impact

Medium

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +39

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Same weakness CWE-20 – Improper Input Validation

View all

CVE-2021-44228 CRITICAL POC

10.0

CVE-2024-3400 CRITICAL POC

10.0

CVE-2022-47966 CRITICAL POC

9.8

CVE-2023-22515 CRITICAL POC

9.8

CVE-2009-0927 HIGH POC

8.8

CVE-2017-9791 CRITICAL POC

9.8

CVE-2017-15944 CRITICAL POC

9.8

CVE-2019-0604 CRITICAL POC

9.8

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2025-68613 HIGH POC

8.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0	Not-Affected

References

Advisories & patches

ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-63855 ADVISORY https://seclists.org/oss-sec/2026/q3/230 ADVISORY https://ubuntu.com/security/notices/USN-8574-1 ADVISORY https://vuldb.com/vuln/380172 REF https://git.kernel.org/stable/c/2c6fb056567efb49f8674108b86088a1cfaa86d0 REF https://git.kernel.org/stable/c/4f317863a3ab212a027d8c8c3cc3af4e3fb95704 REF https://git.kernel.org/stable/c/5a3c6f76cab164a5d803084908d7050f649ab7f9 REF https://git.kernel.org/stable/c/602d4c5872b25ddd4d82fb2025efb9a05b187bb3 REF https://git.kernel.org/stable/c/8156e258025f2a22fcf7486c96848ac3cd3541dd REF https://git.kernel.org/stable/c/8f0ea4524dc71c6c9ec97f2711f46e12f624140f

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back