{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-63854", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-19T07:54:57.016Z", "datePublished": "2026-07-19T14:04:44.487Z", "dateUpdated": "2026-08-05T12:36:32.766Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:36:32.766Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu/vcn: set no_user_fence for VCN v3.0 enc/dec rings\n\nVCN encoder and decoder rings do not support 64-bit user fence writes,\nreject CS submissions with user fences.\n\n(cherry picked from commit 663bed3c7b8b9a7624b0d95d300ddae034ad0614)"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - Exploitation requires issuing DRM_IOCTL_AMDGPU_CS on a local AMDGPU render node (/dev/dri/renderD*); this is a local ioctl path, not a network-reachable interface.\nAC:L - An attacker with render-node access can reliably submit a command stream with AMDGPU_CHUNK_ID_FENCE targeting VCN v3.0 encoder/decoder rings without races or uncontrollable system state.\nPR:L - The vulnerable amdgpu_cs_ioctl path requires only authenticated render-node access (DRM_AUTH|DRM_RENDER_ALLOW), which is available to unprivileged local users on typical Linux systems with AMDGPU hardware.\nUI:N - No victim interaction is required; the attacker directly submits the malformed GPU command stream via ioctl from their own process.\nS:U - The vulnerability operates within the attacker's own AMDGPU/GPU context and does not cross a demonstrated security boundary such as VM escape or IOMMU bypass.\nC:H - Allowing unsupported 64-bit user fence submissions on VCN rings causes GPU-initiated memory writes with incorrect semantics; this class of GPU memory corruption can be leveraged for information disclosure.\nI:H - The bug permits GPU DMA writes to attacker-influenced virtual addresses through malformed user-fence handling, constituting a memory corruption primitive that could enable further exploitation.\nA:H - Malformed fence operations on VCN rings can hang the video engine or trigger GPU reset, causing denial of service affecting graphics and compute availability on the system."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c"], "versions": [{"version": "cf14826cdfb5c9fe10f98210d040b9d7486c381d", "lessThan": "e74fc9c72c1ba78d0de0b849f5929c3b39a8e20c", "status": "affected", "versionType": "git"}, {"version": "cf14826cdfb5c9fe10f98210d040b9d7486c381d", "lessThan": "26c4f38529ac78930c9c4713e16ebc5b689bb0a3", "status": "affected", "versionType": "git"}, {"version": "cf14826cdfb5c9fe10f98210d040b9d7486c381d", "lessThan": "2d6525e7b2504f5bbfe9417cddc1e8da858791dd", "status": "affected", "versionType": "git"}, {"version": "cf14826cdfb5c9fe10f98210d040b9d7486c381d", "lessThan": "b076e45e6f757a2829e80d0144c1b5f201bee5af", "status": "affected", "versionType": "git"}, {"version": "cf14826cdfb5c9fe10f98210d040b9d7486c381d", "lessThan": "f1e5a6660d7cbf006079126d9babbf0ccf538c6b", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c"], "versions": [{"version": "5.9", "status": "affected"}, {"version": "0", "lessThan": "5.9", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.141", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.91", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.33", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0.10", "lessThanOrEqual": "7.0.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.9", "versionEndExcluding": "6.6.141"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.9", "versionEndExcluding": "6.12.91"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.9", "versionEndExcluding": "6.18.33"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.9", "versionEndExcluding": "7.0.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.9", "versionEndExcluding": "7.1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/e74fc9c72c1ba78d0de0b849f5929c3b39a8e20c"}, {"url": "https://git.kernel.org/stable/c/26c4f38529ac78930c9c4713e16ebc5b689bb0a3"}, {"url": "https://git.kernel.org/stable/c/2d6525e7b2504f5bbfe9417cddc1e8da858791dd"}, {"url": "https://git.kernel.org/stable/c/b076e45e6f757a2829e80d0144c1b5f201bee5af"}, {"url": "https://git.kernel.org/stable/c/f1e5a6660d7cbf006079126d9babbf0ccf538c6b"}], "title": "drm/amdgpu/vcn: set no_user_fence for VCN v3.0 enc/dec rings", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "e74fc9c72c1ba78d0de0b849f5929c3b39a8e20c", "status": "affected", "version": "cf14826cdfb5c9fe10f98210d040b9d7486c381d", "versionType": "git"}, {"lessThan": "26c4f38529ac78930c9c4713e16ebc5b689bb0a3", "status": "affected", "version": "cf14826cdfb5c9fe10f98210d040b9d7486c381d", "versionType": "git"}, {"lessThan": "2d6525e7b2504f5bbfe9417cddc1e8da858791dd", "status": "affected", "version": "cf14826cdfb5c9fe10f98210d040b9d7486c381d", "versionType": "git"}, {"lessThan": "b076e45e6f757a2829e80d0144c1b5f201bee5af", "status": "affected", "version": "cf14826cdfb5c9fe10f98210d040b9d7486c381d", "versionType": "git"}, {"lessThan": "f1e5a6660d7cbf006079126d9babbf0ccf538c6b", "status": "affected", "version": "cf14826cdfb5c9fe10f98210d040b9d7486c381d", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.9"}, {"lessThan": "5.9", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.141", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.91", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.33", "versionType": "semver"}, {"lessThanOrEqual": "7.0.*", "status": "unaffected", "version": "7.0.10", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu/vcn: set no_user_fence for VCN v3.0 enc/dec rings\n\nVCN encoder and decoder rings do not support 64-bit user fence writes,\nreject CS submissions with user fences.\n\n(cherry picked from commit 663bed3c7b8b9a7624b0d95d300ddae034ad0614)"}], "id": "CVE-2026-63854", "lastModified": "2026-07-27T17:44:23.777", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-07-19T15:16:52.217", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/26c4f38529ac78930c9c4713e16ebc5b689bb0a3"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/2d6525e7b2504f5bbfe9417cddc1e8da858791dd"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b076e45e6f757a2829e80d0144c1b5f201bee5af"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e74fc9c72c1ba78d0de0b849f5929c3b39a8e20c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/f1e5a6660d7cbf006079126d9babbf0ccf538c6b"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Awaiting Analysis"}

{"bugzilla": {"description": "kernel: drm/amdgpu/vcn: set no_user_fence for VCN v3.0 enc/dec rings", "id": "2502312", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502312"}, "csaw": false, "cwe": "CWE-1287", "details": ["In the Linux kernel, the following vulnerability has been resolved:\ndrm/amdgpu/vcn: set no_user_fence for VCN v3.0 enc/dec rings\nVCN encoder and decoder rings do not support 64-bit user fence writes,\nreject CS submissions with user fences.\n(cherry picked from commit 663bed3c7b8b9a7624b0d95d300ddae034ad0614)", "A flaw was found in the Linux kernel's AMDGPU driver, specifically within the Video Core Next (VCN) version 3.0 encoder and decoder rings. These rings do not support 64-bit user fence writes. A local user could trigger this by attempting to submit commands with 64-bit user fences, which would result in the rejection of these submissions, effectively causing a denial of service for those specific operations."], "name": "CVE-2026-63854", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-07-19T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-63854\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-63854\nhttps://lore.kernel.org/linux-cve-announce/2026071932-CVE-2026-63854-0287@gregkh/T"]}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[cf14826cdfb5c9fe10f98210d040b9d7486c381d,e74fc9c72c1ba78d0de0b849f5929c3b39a8e20c)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[cf14826cdfb5c9fe10f98210d040b9d7486c381d,26c4f38529ac78930c9c4713e16ebc5b689bb0a3)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[cf14826cdfb5c9fe10f98210d040b9d7486c381d,2d6525e7b2504f5bbfe9417cddc1e8da858791dd)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[cf14826cdfb5c9fe10f98210d040b9d7486c381d,b076e45e6f757a2829e80d0144c1b5f201bee5af)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[cf14826cdfb5c9fe10f98210d040b9d7486c381d,f1e5a6660d7cbf006079126d9babbf0ccf538c6b)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "5.9"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,5.9)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.141,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.91,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.33,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.0.10,7.1.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-07-21T08:00:04.017871+00:00", "updated": "2026-08-01T08:00:14.488168+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}