CVE-2026-63852 Overview
CVE-2026-63852 is a Linux kernel vulnerability in the AMD GPU (amdgpu) driver affecting the Video Core Next (VCN) v4.0.3 encoder ring. The VCN encoder and decoder rings do not support 64-bit user fence writes, yet the driver previously accepted command submissions (CS) containing user fences. The upstream fix rejects these submissions by setting no_user_fence on the affected ring. A local, low-privileged user with access to the GPU device can trigger unsafe behavior through crafted command submissions.
Critical Impact
A local authenticated attacker can leverage unsupported user fence writes on VCN v4.0.3 rings to affect confidentiality, integrity, and availability of the kernel driver context.
Affected Products
- Linux kernel builds that include the drm/amdgpu/vcn driver with VCN v4.0.3 support
- AMD GPU platforms exposing the VCN v4.0.3 encoder ring through the DRM command submission interface
- Distributions shipping kernels prior to the backported fix from commit ff1a5a125c5a70c328806b9bc01d7d942cf3f9aa
Discovery Timeline
- 2026-07-19 - CVE-2026-63852 published to NVD
- 2026-07-20 - Last updated in NVD database
Technical Details for CVE-2026-63852
Vulnerability Analysis
The defect resides in the AMD GPU DRM driver path that handles command submissions to the VCN v4.0.3 encoder ring. Video encoder and decoder rings in this generation cannot service 64-bit user fence writes. Despite this hardware constraint, the driver accepted CS ioctl requests that carried user fences targeting these rings. Processing such submissions can lead to unsafe fence writes and inconsistent kernel state visible to a local user with GPU access.
The vulnerability is exploitable locally with low privileges and no user interaction, and it impacts confidentiality, integrity, and availability of resources tied to the affected driver context.
Root Cause
The root cause is a missing capability check on the VCN v4.0.3 encoder and decoder rings. The no_user_fence flag was not set for these rings, so the command submission validator did not reject requests that included user fence pointers. The fix marks the ring as no_user_fence, causing the CS path to reject submissions carrying user fences on rings that cannot safely execute them.
Attack Vector
A local attacker with the ability to open the DRM render node and issue command submissions to the GPU crafts a CS request against the VCN v4.0.3 encoder ring that includes a user fence. Without the guard, the driver accepts the submission and attempts to service a 64-bit user fence write against a ring that does not support it. Exploitation does not require user interaction and no proof-of-concept is publicly available.
Verified code examples were not published with this advisory. Refer to the upstream patch Kernel Git Commit ff1a5a1 (cherry-picked) for the exact modification to the VCN v4.0.3 ring initialization.
Detection Methods for CVE-2026-63852
Indicators of Compromise
- Unexpected amdgpu kernel log entries referencing VCN ring faults, fence timeouts, or CS rejections after user-space workloads targeting video encode paths
- Local processes without a legitimate media pipeline issuing repeated DRM_IOCTL_AMDGPU_CS calls against the VCN encoder ring
- Kernel oops or GPU reset events (amdgpu: GPU reset begin!) originating from the VCN v4.0.3 block
Detection Strategies
- Audit installed kernel package versions against distribution advisories that reference the fix commits 0177ac6, 387b7c7, 4532b52, 9076a83, and c12a5d3
- Enable kernel auditing on the amdgpu module and monitor dmesg for VCN-related warnings and fence write errors
- Correlate DRM ioctl telemetry with process lineage to identify non-media workloads submitting VCN commands
Monitoring Recommendations
- Forward kernel logs to a centralized SIEM and alert on amdgpu VCN ring resets or fence anomalies
- Track local privilege boundaries on multi-tenant Linux hosts where users have access to /dev/dri/renderD* nodes
- Monitor kernel patch level drift across the fleet to ensure the fix is deployed on all AMD GPU-enabled systems
How to Mitigate CVE-2026-63852
Immediate Actions Required
- Update to a Linux kernel release that includes the backported fix cherry-picked from commit ff1a5a125c5a70c328806b9bc01d7d942cf3f9aa
- Restrict access to DRM render nodes on shared systems to trusted users and service accounts only
- Inventory AMD GPU hosts running VCN v4.0.3-capable hardware and prioritize patching
Patch Information
The upstream fix sets no_user_fence on the VCN v4.0.3 encoder ring so that the CS path rejects submissions carrying user fences. Stable tree backports are available in the following commits: 0177ac6, 387b7c7, 4532b52, 9076a83, and c12a5d3. Apply the vendor-supplied kernel package from your Linux distribution once available.
Workarounds
- Tighten permissions on /dev/dri/renderD* to prevent untrusted local users from issuing GPU command submissions
- Where video encoding on VCN v4.0.3 is not required, unload or blacklist amdgpu VCN encoder usage in workloads that do not need it
- Isolate multi-tenant workloads that share AMD GPU hardware using container or VM boundaries with strict device passthrough policies
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
