CVE-2026-63842

What it actually does

The kernel driver for AMD GPU JPEG engines failed to reject command submissions specifying user fences on hardware revisions that lack support for 64-bit user fence writes, allowing invalid operations to proceed and potentially causing memory corruption or kernel crashes.

Why it matters to the business

Local attackers on affected systems can achieve kernel-level memory corruption leading to full system compromise, data breaches, or denial of service on Linux machines with modern AMD GPUs; high urgency due to 99 days of public exposure without listed fixes.

How an attack unfolds

An attacker with local access prepares a command submission containing user fence references and submits it through the DRM interface to the JPEG v5.0.0 ring; the missing input validation allows the unsupported 64-bit fence write to execute, resulting in undefined kernel behavior.

How to fix it

Apply the upstream commit 0f43893d3cd478fa57836697525b338817c9c23d or any equivalent distribution backport that enforces no_user_fence on JPEG v5.0.0 rings; rebuild and deploy updated kernel packages to all affected hosts.

How to confirm the fix worked

Inspect amdgpu/jpeg driver source for the no_user_fence flag on v5.0.0 rings and confirm that CS submissions with user fences are rejected; perform regression tests using DRM command submission tools on patched kernels.

Typical attack path

1. Obtain local user access on a Linux system with an affected AMD GPU
2. Locate the JPEG ring via DRM/amdgpu interfaces
3. Craft a command stream buffer that includes user fence parameters
4. Submit the buffer using standard DRM ioctl paths
5. Trigger kernel execution of the invalid fence write

How to detect it

Review kernel logs for amdgpu or drm errors during command submission, audit user-space processes issuing unusual DRM ioctls to JPEG rings, and examine audit trails for unexpected graphics context creation.

What your security team should do

• Immediately schedule kernel updates for all Linux systems containing AMD GPUs
• Restrict unprivileged access to DRM interfaces where feasible until patches are applied
• Review and harden local user permissions on graphics workloads
• Monitor kernel update channels for backported fixes