CVE-2026-63844 (GCVE-0-2026-63844)

Vulnerability from cvelistv5 – Published: 2026-07-19 14:04 – Updated: 2026-08-05 12:36
VLAI
Title
drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0.3 ring
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0.3 ring JPEG rings do not support 64-bit user fence writes, reject CS submissions with user fences. (cherry picked from commit 2f6afc97d259d530f4f86c7743efbc573a8da927)
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: e684e654eba9481a9f462a7bbf5c385b7d1c076e , < b884ff67d62ef514eee9d5f605c03101c8b6bc98 (git)
Affected: e684e654eba9481a9f462a7bbf5c385b7d1c076e , < d6bd2a5fd611ec9c8a2411f084cff2435c709608 (git)
Affected: e684e654eba9481a9f462a7bbf5c385b7d1c076e , < 8549b3933038e68dc61cb934b9a54223dd244a78 (git)
Affected: e684e654eba9481a9f462a7bbf5c385b7d1c076e , < 249fa7549736de1c8e327d7ca6b32fa148a40bd6 (git)
Affected: e684e654eba9481a9f462a7bbf5c385b7d1c076e , < 83e37c0987ca92f9e87789b46dd311dcf5a4a6c8 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.5
Unaffected: 0 , < 6.5 (semver)
Unaffected: 6.6.141 , ≤ 6.6.* (semver)
Unaffected: 6.12.91 , ≤ 6.12.* (semver)
Unaffected: 6.18.33 , ≤ 6.18.* (semver)
Unaffected: 7.0.10 , ≤ 7.0.* (semver)
Unaffected: 7.1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/amdgpu/jpeg_v4_0_3.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b884ff67d62ef514eee9d5f605c03101c8b6bc98",
              "status": "affected",
              "version": "e684e654eba9481a9f462a7bbf5c385b7d1c076e",
              "versionType": "git"
            },
            {
              "lessThan": "d6bd2a5fd611ec9c8a2411f084cff2435c709608",
              "status": "affected",
              "version": "e684e654eba9481a9f462a7bbf5c385b7d1c076e",
              "versionType": "git"
            },
            {
              "lessThan": "8549b3933038e68dc61cb934b9a54223dd244a78",
              "status": "affected",
              "version": "e684e654eba9481a9f462a7bbf5c385b7d1c076e",
              "versionType": "git"
            },
            {
              "lessThan": "249fa7549736de1c8e327d7ca6b32fa148a40bd6",
              "status": "affected",
              "version": "e684e654eba9481a9f462a7bbf5c385b7d1c076e",
              "versionType": "git"
            },
            {
              "lessThan": "83e37c0987ca92f9e87789b46dd311dcf5a4a6c8",
              "status": "affected",
              "version": "e684e654eba9481a9f462a7bbf5c385b7d1c076e",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/amdgpu/jpeg_v4_0_3.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.5"
            },
            {
              "lessThan": "6.5",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.141",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.91",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.33",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.141",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.91",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.33",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.10",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu/jpeg: set no_user_fence for JPEG v4.0.3 ring\n\nJPEG rings do not support 64-bit user fence writes, reject CS\nsubmissions with user fences.\n\n(cherry picked from commit 2f6afc97d259d530f4f86c7743efbc573a8da927)"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires local access to the AMDGPU DRM render node and the DRM_IOCTL_AMDGPU_CS ioctl path; there is no network, adjacent-wireless, or physical-access entry point to the vulnerable JPEG ring submission code.\nAC:L - An attacker with render-node access can deterministically submit a command stream to the VCN JPEG ring with an AMDGPU_CHUNK_ID_FENCE user-fence chunk; no race or attacker-uncontrollable memory layout is required beyond having affected VCN 4.0.3 hardware.\nPR:L - The vulnerable amdgpu_cs_ioctl handler is gated by DRM_AUTH|DRM_RENDER_ALLOW, requiring a local unprivileged user with access to /dev/dri/renderD* (typically the render/video group), not root or capabilities obtainable only in the init namespace.\nUI:N - Once the attacker has render-node access, triggering the bug is fully programmatic via ioctl/GEM setup and does not require any additional victim interaction such as opening files or mounting filesystems.\nS:U - Impact is confined to the AMDGPU driver/GPU memory domain of the submitting process\u0027s security context; this is not a KVM guest-to-host escape, IOMMU bypass, or other cross-authority boundary crossing.\nC:H - Incorrect 64-bit user-fence handling on JPEG hardware can cause GPU-initiated writes to unintended addresses in GPU-visible memory, a memory-corruption primitive that can be leveraged for arbitrary kernel/GPU memory disclosure beyond the intended fence buffer.\nI:H - The bug allows the GPU to perform unintended memory writes when processing user-fence completion on a ring that lacks 64-bit user-fence support, providing a writable corruption primitive that could be developed into further code execution or privilege escalation.\nA:H - Submitting unsupported user fences to the JPEG v4.0.3 ring can hang or reset the GPU/firmware and trigger repeated denial of service on affected AMD systems (workstations, laptops, cloud GPU instances) using VCN 4.0.3."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:36:21.992Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b884ff67d62ef514eee9d5f605c03101c8b6bc98"
        },
        {
          "url": "https://git.kernel.org/stable/c/d6bd2a5fd611ec9c8a2411f084cff2435c709608"
        },
        {
          "url": "https://git.kernel.org/stable/c/8549b3933038e68dc61cb934b9a54223dd244a78"
        },
        {
          "url": "https://git.kernel.org/stable/c/249fa7549736de1c8e327d7ca6b32fa148a40bd6"
        },
        {
          "url": "https://git.kernel.org/stable/c/83e37c0987ca92f9e87789b46dd311dcf5a4a6c8"
        }
      ],
      "title": "drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0.3 ring",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-63844",
    "datePublished": "2026-07-19T14:04:38.452Z",
    "dateReserved": "2026-07-19T07:54:57.015Z",
    "dateUpdated": "2026-08-05T12:36:21.992Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-63844",
      "date": "2026-09-21",
      "epss": "0.00142",
      "percentile": "0.03829"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/gpu/drm/amd/amdgpu/jpeg_v4_0_3.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "b884ff67d62ef514eee9d5f605c03101c8b6bc98",
                    "status": "affected",
                    "version": "e684e654eba9481a9f462a7bbf5c385b7d1c076e",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "d6bd2a5fd611ec9c8a2411f084cff2435c709608",
                    "status": "affected",
                    "version": "e684e654eba9481a9f462a7bbf5c385b7d1c076e",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "8549b3933038e68dc61cb934b9a54223dd244a78",
                    "status": "affected",
                    "version": "e684e654eba9481a9f462a7bbf5c385b7d1c076e",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "249fa7549736de1c8e327d7ca6b32fa148a40bd6",
                    "status": "affected",
                    "version": "e684e654eba9481a9f462a7bbf5c385b7d1c076e",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "83e37c0987ca92f9e87789b46dd311dcf5a4a6c8",
                    "status": "affected",
                    "version": "e684e654eba9481a9f462a7bbf5c385b7d1c076e",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/gpu/drm/amd/amdgpu/jpeg_v4_0_3.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.5"
                  },
                  {
                    "lessThan": "6.5",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.141",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.91",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.33",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.0.*",
                    "status": "unaffected",
                    "version": "7.0.10",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu/jpeg: set no_user_fence for JPEG v4.0.3 ring\n\nJPEG rings do not support 64-bit user fence writes, reject CS\nsubmissions with user fences.\n\n(cherry picked from commit 2f6afc97d259d530f4f86c7743efbc573a8da927)"
          }
        ],
        "id": "CVE-2026-63844",
        "lastModified": "2026-07-27T17:44:23.777",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-07-19T15:16:51.187",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/249fa7549736de1c8e327d7ca6b32fa148a40bd6"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/83e37c0987ca92f9e87789b46dd311dcf5a4a6c8"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/8549b3933038e68dc61cb934b9a54223dd244a78"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/b884ff67d62ef514eee9d5f605c03101c8b6bc98"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/d6bd2a5fd611ec9c8a2411f084cff2435c709608"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Awaiting Analysis"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-07-31T18:58:11+00:00",
      "cve": "CVE-2026-63844",
      "id": "CVE-2026-63844",
      "initial_release_date": "2026-07-19T00:00:00+00:00",
      "product_status:known_affected": "198",
      "product_status:known_not_affected": "76",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0.3 ring",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-63844.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-18T00:47:44Z",
      "cve": "CVE-2026-63844",
      "id": "CVE-2026-63844",
      "initial_release_date": "2026-07-24T02:13:55Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "424",
      "product_status:known_not_affected": "287",
      "product_status:recommended": "250",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-63844",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-63844.json",
      "version": "9"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.