CVE-2026-63854: Linux Kernel AMDGPU VCN Vulnerability

CVE-2026-63854 Overview

CVE-2026-63854 is a Linux kernel vulnerability in the AMD GPU (amdgpu) driver, specifically in the Video Core Next (VCN) v3.0 encoder and decoder rings. The VCN encoder and decoder rings do not support 64-bit user fence writes, but the driver previously accepted command submissions (CS) containing user fences. The fix rejects such submissions by setting the no_user_fence flag for VCN v3.0 enc/dec rings. The vulnerability requires local access with low privileges and can impact confidentiality, integrity, and availability on affected systems.

Critical Impact
A local, low-privileged user submitting crafted command streams to the VCN v3.0 rings can trigger unsupported user fence writes, leading to high-impact confidentiality, integrity, and availability consequences on the host.

Affected Products

Linux kernel builds shipping the drm/amdgpu/vcn driver with VCN v3.0 encoder/decoder rings
Distributions packaging affected mainline and stable Linux kernel releases prior to the referenced fix commits
Systems using AMD GPUs that expose VCN v3.0 encode/decode functionality via the DRM subsystem

Discovery Timeline

2026-07-19 - CVE-2026-63854 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-63854

Vulnerability Analysis

The vulnerability resides in the drm/amdgpu/vcn driver of the Linux kernel. The VCN v3.0 encoder and decoder rings on AMD GPUs do not support 64-bit user fence writes. The command submission path did not enforce this hardware constraint, allowing userspace to submit CS ioctls containing user fences targeted at these rings.

When the kernel processes such submissions, the ring attempts operations it cannot correctly perform. This creates unsafe behavior in the graphics command pipeline, exposing the system to kernel-mode side effects driven by unprivileged local input. The fix, backported from upstream commit 663bed3c7b8b9a7624b0d95d300ddae034ad0614, sets the no_user_fence property for VCN v3.0 enc/dec rings so the CS path rejects offending submissions early.

Root Cause

The root cause is missing input validation in the command submission logic for VCN v3.0 rings. The driver failed to advertise that the ring lacks support for 64-bit user fence writes, and the CS validator therefore accepted user fence descriptors bound to those rings.

Attack Vector

Exploitation is local. A user with access to the /dev/dri/renderD* device node can craft a DRM_IOCTL_AMDGPU_CS submission that targets the VCN v3.0 encode or decode ring and embeds a user fence. Processing the submission drives the ring into an unsupported code path.

// No verified public proof-of-concept exists for CVE-2026-63854.
// See the upstream commit references for the exact code change:
//   https://git.kernel.org/stable/c/663bed3c7b8b9a7624b0d95d300ddae034ad0614

Detection Methods for CVE-2026-63854

Indicators of Compromise

Unexpected amdgpu errors, GPU hangs, or ring resets logged in dmesg from processes issuing VCN encode or decode workloads
Kernel warnings referencing vcn rings, fence timeouts, or CS submission failures on hosts running vulnerable kernel versions
Local processes with no legitimate media workload issuing repeated DRM_IOCTL_AMDGPU_CS calls targeting VCN rings

Detection Strategies

Inventory running kernel versions across Linux endpoints and servers and compare against the fixed commits 26c4f38, 2d6525e, b076e45, e74fc9c, and f1e5a66
Monitor kernel ring buffer output for amdgpu and vcn subsystem faults correlated with untrusted local users
Audit which local accounts and containers have access to /dev/dri/render* nodes and can reach the amdgpu CS ioctl

Monitoring Recommendations

Forward journalctl -k and /var/log/kern.log entries containing amdgpu or vcn tags to a centralized log store for correlation
Alert on unusual GPU ring reset or fence timeout events originating from non-media workloads
Track process-level ioctl activity on DRM render nodes to identify anomalous submitters

How to Mitigate CVE-2026-63854

Immediate Actions Required

Upgrade to a Linux kernel release that includes one of the fix commits: 26c4f38, 2d6525e, b076e45, e74fc9c, or f1e5a66
Apply distribution-provided kernel security updates once available and reboot affected hosts
Restrict access to DRM render nodes so only trusted local users and services can submit GPU command streams

Patch Information

The upstream fix sets no_user_fence for VCN v3.0 encoder and decoder rings so the command submission path rejects user fence requests these rings cannot service. The change was cherry-picked from mainline commit 663bed3c7b8b9a7624b0d95d300ddae034ad0614 and landed in the stable trees referenced by the following commits: Kernel Git Commit 26c4f38, Kernel Git Commit 2d6525e, Kernel Git Commit b076e45, Kernel Git Commit e74fc9c, and Kernel Git Commit f1e5a66.

Workarounds

Tighten permissions on /dev/dri/render* so untrusted users and containers cannot issue amdgpu CS ioctls
Where feasible, blacklist or unload the amdgpu module on systems that do not need AMD GPU acceleration until the kernel is patched
Isolate workloads that require GPU access into hardened VMs or namespaces to limit exposure of the host kernel

bash

# Verify running kernel version and confirm the amdgpu module is loaded
uname -r
lsmod | grep amdgpu

# Restrict render node access to the 'render' group only
ls -l /dev/dri/renderD*
sudo chown root:render /dev/dri/renderD*
sudo chmod 0660 /dev/dri/renderD*