CVE-2026-63842: drm/amdgpu/jpeg: set no_user_fence for JPEG v5.0.0 ring
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu/jpeg: set nouserfence for JPEG v5.0.0 ring
JPEG rings do not support 64-bit user fence writes, reject CS submissions with user fences.
(cherry picked from commit 0f43893d3cd478fa57836697525b338817c9c23d)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Set no_user_fence for the JPEG v5.0.0 ring so submissions with user fences are rejected.
Linux kernel drm/amdgpu JPEG v5.0.0 ring no_user_fence = true
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems running the Linux kernel with the AMDGPU JPEG v5.0.0 ring are potentially exposed. Exploitation requires local access and low privileges.
What does an attacker need to do to trigger it?
An attacker needs to submit command streams using user fences to a JPEG ring. The affected JPEG rings do not support 64-bit user-fence writes.
What mitigation is available if an update cannot be applied immediately?
Reject command-stream submissions containing user fences for the JPEG v5.0.0 ring. This is the behavior implemented by setting no_user_fence for that ring.