CVE-2026-63850: Linux Kernel Privilege Escalation Flaw

CVE-2026-63850 Overview

CVE-2026-63850 is a Linux kernel vulnerability in the AMD GPU (amdgpu) driver affecting the Video Core Next (VCN) v5.0.0 encoder ring. The VCN encoder and decoder rings do not support 64-bit user fence writes, but command submissions (CS) with user fences were not rejected. A local attacker with access to the GPU device can trigger unsafe fence handling by submitting crafted command streams. The upstream fix sets the no_user_fence flag for the VCN v5.0.0 encoder ring and rejects CS submissions carrying user fences.

Critical Impact
Local attackers with GPU access can compromise confidentiality, integrity, and availability of affected Linux systems through malformed VCN command submissions.

Affected Products

Linux kernel versions containing the drm/amdgpu/vcn driver with VCN v5.0.0 support
Systems using AMD GPUs with VCN v5.0.0 encoder/decoder hardware
Distributions shipping unpatched stable kernel branches prior to the cherry-picked fix

Discovery Timeline

2026-07-19 - CVE-2026-63850 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-63850

Vulnerability Analysis

The vulnerability resides in the amdgpu Direct Rendering Manager (DRM) driver, specifically in the VCN v5.0.0 encoder ring initialization path. The VCN block on AMD GPUs handles hardware-accelerated video encoding and decoding. User-space clients submit command streams (CS) through the DRM interface, and these submissions can request user fences — 64-bit values written by the GPU to signal command completion.

The VCN v5.0.0 encoder ring hardware lacks support for 64-bit user fence writes. The driver did not enforce this constraint, allowing CS submissions containing user fences to reach the ring. This creates a mismatch between what the driver accepts and what the hardware can safely execute, resulting in undefined behavior in kernel memory operations. The issue is classified as a kernel driver vulnerability with local attack requirements and low privilege prerequisites.

Root Cause

The root cause is missing input validation on the encoder ring configuration. The no_user_fence flag, which instructs the CS validation path to reject submissions carrying user fences, was not set for the VCN v5.0.0 encoder ring. Without this flag, the CS ioctl accepted requests that the hardware could not honor.

Attack Vector

Exploitation requires local access with permission to open the /dev/dri/renderD* device node, which is typically granted to logged-in users or containers with GPU passthrough. An attacker crafts a DRM_IOCTL_AMDGPU_CS request targeting the VCN v5.0.0 encoder ring and includes a user fence descriptor. The kernel processes the submission along a code path unsupported by the hardware, producing memory corruption or state inconsistency that can affect kernel integrity and availability.

No public proof-of-concept exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS probability is 0.129%.

Detection Methods for CVE-2026-63850

Indicators of Compromise

Unexpected kernel oops or panic messages referencing amdgpu_vcn, amdgpu_cs_ioctl, or VCN ring functions in dmesg
Unusual GPU reset events logged by the amdgpu driver following user-space workloads
Local processes issuing repeated DRM_IOCTL_AMDGPU_CS calls targeting VCN encoder rings from unprivileged accounts

Detection Strategies

Monitor kernel logs for amdgpu ring timeouts, fence errors, and VCN-related warnings correlated with user workloads
Audit which local accounts and containers hold access to /dev/dri/renderD* devices and correlate access with unexpected GPU faults
Track kernel version and patch state across the fleet to identify hosts still exposing the vulnerable code path

Monitoring Recommendations

Collect dmesg and journalctl -k output centrally and alert on amdgpu fault or reset patterns
Baseline normal GPU ioctl activity per workload and flag deviations, especially from non-graphics processes
Track kernel package versions through configuration management and generate reports for hosts running unpatched kernels

How to Mitigate CVE-2026-63850

Immediate Actions Required

Apply the upstream stable kernel patches referenced in the Kernel Git Commit Log and rebuild or update affected kernels
Restrict access to /dev/dri/renderD* device nodes to trusted users and service accounts through group membership and udev rules
Inventory Linux hosts using AMD GPUs with VCN v5.0.0 hardware and prioritize them for patching

Patch Information

The fix sets no_user_fence for the VCN v5.0.0 encoder ring, causing the CS validation path to reject submissions with user fences. The change was cherry-picked from upstream commit 49b1fbbb5a071197ee71e2d70959b1cb29bdc317 and backported to stable branches via commits 139a8a52, 2c350f3c, 8cae0ce7, and 9f5a1459. Consult your distribution's security advisory for the corresponding kernel package version.

Workarounds

Deny non-essential local users membership in the render and video groups to reduce the exposed attack surface
Disable hardware video acceleration in workloads that do not require it, preventing user-space clients from opening VCN rings
Use mandatory access control profiles (SELinux, AppArmor) to constrain which processes can issue DRM ioctls on GPU devices

bash

# Configuration example: restrict render node access via udev
# /etc/udev/rules.d/99-amdgpu-render.rules
KERNEL=="renderD*", SUBSYSTEM=="drm", MODE="0660", GROUP="render"

# Verify current kernel version against patched builds
uname -r

# List users currently in the render group
getent group render