CVE-2026-63847 Overview
CVE-2026-63847 is a Linux kernel vulnerability in the AMDGPU JPEG v2.5 ring driver (drm/amdgpu/jpeg). The JPEG rings do not support 64-bit user fence writes, but the driver previously accepted command submissions (CS) containing user fences. This mismatch created a memory safety condition that a local, authenticated user could trigger through crafted GPU command submissions. The upstream fix sets the no_user_fence flag for the JPEG v2.5 ring and rejects CS submissions carrying user fences.
Critical Impact
A local user with access to the AMDGPU DRM device can trigger the flaw via command submission, potentially compromising confidentiality, integrity, and availability of the affected system.
Affected Products
- Linux kernel builds including the AMDGPU driver with JPEG v2.5 ring support
- Systems running AMD GPUs that expose the JPEG v2.5 engine through drm/amdgpu
- Distribution kernels prior to backport of upstream commit 3216a7f4e2642bda5fd14f57586e835ae9202587
Discovery Timeline
- 2026-07-19 - CVE-2026-63847 published to NVD
- 2026-07-20 - Last updated in NVD database
Technical Details for CVE-2026-63847
Vulnerability Analysis
The vulnerability resides in the AMDGPU JPEG driver code path that processes DRM command submissions. AMDGPU exposes several ring types for GPU work, and each ring declares whether it supports user fences. User fences allow userspace to request a 64-bit fence value be written to a specified GPU address when a submission completes. The JPEG v2.5 ring hardware cannot perform these 64-bit writes correctly, yet the kernel accepted submissions that requested them. The result is an inconsistent state between what userspace expects and what the ring can honor, producing conditions exploitable by a local attacker with access to the render node.
Root Cause
The JPEG v2.5 ring configuration in drm/amdgpu/jpeg did not set the no_user_fence attribute. As a result, the command submission path in amdgpu_cs did not reject requests that attached user fences to JPEG rings. The fix, cherry-picked from commit 3216a7f4e2642bda5fd14f57586e835ae9202587, marks the JPEG v2.5 ring with no_user_fence so the CS ioctl rejects such submissions early.
Attack Vector
Exploitation requires local access with permissions to open the AMDGPU DRM render node, typically granted to any logged-in user through the video or render group. An attacker crafts an AMDGPU_CS ioctl targeting the JPEG v2.5 ring with a user fence attached. The malformed submission then reaches ring code that cannot honor a 64-bit fence write, corrupting kernel or GPU state. The CVSS vector indicates high impact to confidentiality, integrity, and availability with no user interaction. EPSS scoring places exploitation likelihood at a low probability for the current 30-day window.
See the upstream patches for technical detail: Kernel Git Security Patch and Kernel Git Commit Fix.
Detection Methods for CVE-2026-63847
Indicators of Compromise
- Unexpected amdgpu ring resets or GPU hangs logged in dmesg, referencing the JPEG engine
- Kernel messages showing rejected or malformed CS submissions from unprivileged processes
- Unusual crashes of graphics or media processes that submit work to the JPEG ring
Detection Strategies
- Monitor kernel logs for amdgpu errors mentioning jpeg, ring, or user fence reject messages after applying the patch
- Audit which local user accounts have access to /dev/dri/renderD* nodes and correlate with process activity
- Track kernel version and module build metadata to identify hosts still running unpatched AMDGPU code
Monitoring Recommendations
- Ship dmesg and journalctl -k output to a centralized log platform for GPU driver anomaly analysis
- Alert on repeated CS submission failures or ring recovery events from a single UID
- Include GPU driver version in host inventory to prioritize patch rollout
How to Mitigate CVE-2026-63847
Immediate Actions Required
- Update to a Linux kernel release containing the upstream AMDGPU JPEG fix backport
- Restrict access to /dev/dri/renderD* render nodes to trusted users and service accounts
- Reboot affected hosts after kernel package updates to load the patched module
Patch Information
The fix was cherry-picked from upstream commit 3216a7f4e2642bda5fd14f57586e835ae9202587 and distributed across multiple stable branches. Reference the following commits when validating your kernel build: Kernel Git Commit Update, Kernel Git Commit Fix, Kernel Git Security Patch, Kernel Git Commit Change, and Kernel Git Commit Improvement.
Workarounds
- Blacklist the amdgpu module on systems that do not require AMD GPU acceleration until a patched kernel is deployed
- Remove membership of untrusted users from the render and video groups to limit DRM device access
- Use mandatory access controls such as SELinux or AppArmor to restrict which binaries may open AMDGPU render nodes
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
