Cloudanix VulnDB

CVE-2026-63850

High · 7.8

CVSS

7.8

EPSS

0.2%

Published

Jul 19, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A bug in the Linux graphics driver for certain AMD video chips lets local users submit bad commands that can crash the whole computer or take over the system.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Low
Impact
Full Compromise
Component
OS kernel
Class
Improper Input Validation
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The vulnerability permits submission of command streams containing user fences to VCN v5.0.0 encoder and decoder rings that lack support for 64-bit user fence writes, due to missing input validation that should reject such submissions.

Why it matters to the business

Local attackers on systems with affected AMD GPUs can trigger kernel-level failures during graphics or video encoding workloads, leading to system instability, potential data corruption, or escalation of privileges without network access.

How an attack unfolds

An attacker with local user access crafts and submits command stream buffers that include unsupported user fences to the amdgpu VCN rings; the kernel fails to reject them, allowing invalid fence operations that corrupt kernel state or cause crashes.

How to fix it

Upgrade the Linux kernel to a version containing commit 49b1fbbb5a071197ee71e2d70959b1cb29bdc317 or later equivalent that enforces no_user_fence for VCN v5.0.0 rings; rebuild and reboot with the patched kernel.

How to confirm the fix worked

Verify the presence of the fix by checking kernel source for the no_user_fence flag on VCN v5.0.0 enc ring or confirm the commit hash in the running kernel build; test by attempting a user-fence CS submission and confirming rejection.

Typical attack path

  1. Gain local shell access on a Linux system with AMD GPU using VCN v5.0.0
  2. Load or interact with the amdgpu kernel driver
  3. Prepare and submit a CS buffer containing 64-bit user fences via ioctl or userspace graphics API
  4. Trigger ring processing to exploit missing validation and achieve denial of service or code execution

How to detect it

Review kernel logs (dmesg, journalctl) for amdgpu VCN ring submission errors or fence validation messages; examine userspace graphics library calls or strace output for fence-related ioctls targeting VCN rings.

What your security team should do

  • Prioritize kernel updates on all systems with AMD VCN 5.0.0 hardware due to high local impact
  • Restrict unprivileged local access where possible until patched
  • Monitor kernel logs for amdgpu VCN fence-related warnings after deployment

The record

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vcn: set no_user_fence for VCN v5.0.0 enc ring VCN encoder and decoder rings do not support 64-bit user fence writes, reject CS submissions with user fences. (cherry picked from commit 49b1fbbb5a071197ee71e2d70959b1cb29bdc317)

Affected packages

Ecosystem Package Introduced Fixed