CVE-2026-63844: Linux Kernel Privilege Escalation Flaw

CVE-2026-63844 Overview

CVE-2026-63844 is a Linux kernel vulnerability in the AMD GPU (amdgpu) driver's JPEG engine. The flaw affects the JPEG v4.0.3 ring, which does not support 64-bit user fence writes. The kernel accepted command submissions (CS) containing user fences on this ring, leading to unsafe operations against hardware that cannot service them. The upstream fix sets no_user_fence for the JPEG v4.0.3 ring and rejects CS submissions that specify user fences. The issue requires local access with low privileges and no user interaction.

Critical Impact
A local user with access to the amdgpu DRM device can trigger unsupported user fence operations on the JPEG v4.0.3 ring, resulting in high impact to confidentiality, integrity, and availability of the affected host.

Affected Products

Linux kernel builds including the drm/amdgpu/jpeg driver prior to the referenced stable commits
Systems using AMD GPUs exposing the JPEG v4.0.3 ring through amdgpu
Distributions shipping stable kernels that have not yet backported the fix

Discovery Timeline

2026-07-19 - CVE-2026-63844 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-63844

Vulnerability Analysis

The vulnerability resides in the AMD GPU DRM driver's JPEG subsystem, specifically the JPEG v4.0.3 ring initialization path. JPEG rings on this hardware revision do not implement 64-bit user fence writes. Prior to the fix, the driver did not mark the ring with no_user_fence, so command submissions that requested user fence semantics were accepted and dispatched. The mismatch between what userspace requested and what the ring hardware supports allowed unsafe kernel operations tied to fence signaling.

The fix, cherry-picked from upstream commit 2f6afc97d259d530f4f86c7743efbc573a8da927, sets the no_user_fence property on the JPEG v4.0.3 ring. The command submission path then rejects any CS ioctl carrying a user fence for that ring instead of processing it. This kernel-space flaw is classified as a driver vulnerability in the local attack surface category.

Root Cause

The root cause is a missing capability flag on the JPEG v4.0.3 ring. The driver did not declare that the ring lacks 64-bit user fence write support, so the generic amdgpu CS submission logic proceeded as if user fences were valid. The absence of validation combined with hardware that cannot service the requested fence writes produced the exploitable condition.

Attack Vector

A local, authenticated attacker with access to the amdgpu DRM device node submits a crafted command stream via the CS ioctl that specifies a user fence on the JPEG v4.0.3 ring. Because the driver does not reject the submission, the operation reaches hardware that cannot honor the fence write, corrupting kernel-tracked state and impacting confidentiality, integrity, and availability of the local system. No network access or user interaction is required.

No public exploit is available for CVE-2026-63844, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Technical details are documented across the referenced stable branch commits.

Detection Methods for CVE-2026-63844

Indicators of Compromise

Unexpected kernel warnings or oops entries in dmesg referencing amdgpu, jpeg_v4_0_3, or ring submission failures
Local processes issuing repeated DRM_IOCTL_AMDGPU_CS calls that target the JPEG ring with user fence fields set
Unexplained GPU resets or hangs on hosts equipped with AMD GPUs exposing JPEG v4.0.3

Detection Strategies

Audit installed kernel packages against distribution advisories referencing the amdgpu JPEG v4.0.3 fix
Enable kernel lockdown, kprobes, or auditd rules on the DRM ioctl surface to log command submission patterns from unprivileged users
Correlate GPU driver crash telemetry with process ancestry to identify local users invoking JPEG ring submissions

Monitoring Recommendations

Forward kernel logs to a central data lake and alert on amdgpu fault signatures such as ring timeouts or fence assertion failures
Track sudden increases in DRM ioctl volume from non-graphical workloads on servers with AMD GPUs
Monitor for unscheduled GPU resets that coincide with local user activity on multi-tenant Linux hosts

How to Mitigate CVE-2026-63844

Immediate Actions Required

Apply the stable kernel updates containing the no_user_fence fix for the JPEG v4.0.3 ring on all affected Linux hosts
Prioritize patching multi-tenant systems and workstations where untrusted local users have access to the amdgpu device
Restrict access to /dev/dri/* device nodes to trusted user groups until patches are deployed

Patch Information

The fix is a cherry-pick of upstream commit 2f6afc97d259d530f4f86c7743efbc573a8da927 and is available across stable branches via the following commits: 249fa7549736, 83e37c0987ca, 8549b3933038, b884ff67d62e, and d6bd2a5fd611. Rebuild or install a distribution kernel that incorporates these commits and reboot to activate the fix.

Workarounds

Limit local shell access on systems with AMD GPUs exposing JPEG v4.0.3 until the kernel update is applied
Remove untrusted users from the video and render groups so they cannot open the DRM device node
Where JPEG hardware acceleration is not required, blacklist or unbind the amdgpu JPEG functionality via kernel module parameters until patched

bash

# Verify running kernel version and confirm the amdgpu JPEG fix is present
uname -r
grep -R "no_user_fence" /usr/src/linux-headers-$(uname -r)/include/ 2>/dev/null

# Restrict DRM device access to a trusted group as a temporary mitigation
sudo chgrp trusted-render /dev/dri/renderD128
sudo chmod 660 /dev/dri/renderD128