CVE-2026-63840: drm/amdgpu/jpeg: set no_user_fence for JPEG v5.3.0 ring
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu/jpeg: set nouserfence for JPEG v5.3.0 ring
JPEG rings do not support 64-bit user fence writes, reject CS submissions with user fences.
(cherry picked from commit 86ac011ae234c03fb872f4945913391ea1d8862e)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Set no_user_fence for the JPEG v5.3.0 ring to reject command submissions with user fences.
Linux kernel DRM AMDGPU JPEG v5.3.0 ring no_user_fence = true
Event History
Frequently Asked Questions
What level of access does an attacker need?
The CVSS vector indicates local access, low privileges, and no user interaction are required. The issue is therefore relevant to users or processes that can submit work to the affected GPU driver.
Which hardware or driver path is implicated?
The affected path is the AMDGPU JPEG v5.3.0 ring. The problem occurs when command submissions use user fences, because these JPEG rings do not support 64-bit user-fence writes.
What does the resolved behavior change?
The fix marks the JPEG v5.3.0 ring as not supporting user fences and rejects command submissions that include them. This prevents unsupported 64-bit user-fence writes from being issued on that ring.
How severe is the potential impact?
The supplied CVSS 3.1 score is 7.8 high, with high impacts to confidentiality, integrity, and availability. Scope is listed as unchanged.