CVE-2026-63845: drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0 ring
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu/jpeg: set nouserfence for JPEG v4.0 ring
JPEG rings do not support 64-bit user fence writes, reject CS submissions with user fences.
(cherry picked from commit 8d0cac9478a3f046279c657d6a2545de49ae675a)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.191 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.141 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.91 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.33 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.0.10 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.94-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.0.10-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.14-1 - Configuration
Set no_user_fence for the JPEG v4.0 ring to reject command-stream submissions with user fences.
Linux kernel amdgpu JPEG v4.0 ring no_user_fence = true
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The issue has local attack vector, low attack complexity, and requires low privileges. No user interaction is required.
Which systems are exposed?
Systems using the Linux kernel with the AMDGPU JPEG v4.0 ring are relevant. The affected operation is command-stream submission that includes user fences.
What changes in the resolved version?
The JPEG v4.0 ring is marked to disallow user fences, causing command-stream submissions with user fences to be rejected because these rings do not support 64-bit user-fence writes.