CVE-2026-63855 Overview
CVE-2026-63855 is a Linux kernel vulnerability in the AMD GPU (amdgpu) driver, specifically in the Video Core Next (VCN) v2.5 encoder and decoder ring handling. The VCN v2.5 encoder and decoder rings do not support 64-bit user fence writes, but the driver previously accepted command submission (CS) requests containing user fences on these rings. The kernel maintainers resolved the issue by setting no_user_fence for VCN v2.5 enc/dec rings, rejecting CS submissions that specify user fences.
The flaw was cherry-picked from upstream commit efc9dd5590894109bce9a0bfe1fa5592dd6b20b1 and backported across multiple stable kernel branches.
Critical Impact
A local, low-privileged user submitting crafted graphics command streams to the VCN v2.5 rings can trigger memory corruption or kernel-level integrity issues, with impact on confidentiality, integrity, and availability.
Affected Products
- Linux kernel builds including the amdgpu VCN v2.5 driver code path
- Systems using AMD GPUs that expose VCN v2.5 encoder and decoder rings
- Multiple stable Linux kernel branches prior to the referenced backport commits
Discovery Timeline
- 2026-07-19 - CVE-2026-63855 published to NVD
- 2026-07-20 - Last updated in NVD database
Technical Details for CVE-2026-63855
Vulnerability Analysis
The vulnerability resides in the AMD GPU driver's handling of VCN v2.5 encoder and decoder rings within the Linux kernel Direct Rendering Manager (DRM) subsystem. VCN rings process video encode and decode workloads submitted from userspace through the amdgpu command submission (CS) interface.
Userspace applications can attach a user fence to a CS submission. A user fence instructs the GPU to write a 64-bit completion value to a userspace-visible memory location when the command completes. This mechanism enables efficient GPU-to-CPU synchronization.
VCN v2.5 encoder and decoder rings, however, do not support 64-bit user fence writes. Accepting user fences on these rings caused the kernel to program hardware operations that the ring cannot correctly execute, leading to inconsistent state in the driver and userspace memory. The fix marks these rings with the no_user_fence attribute so the CS ioctl rejects such submissions early.
Root Cause
The root cause is missing input validation on the ring capability. The amdgpu CS path did not consult a no_user_fence flag for VCN v2.5 enc/dec rings before accepting user fence descriptors. Submissions targeting a ring without genuine 64-bit user fence support were dispatched anyway, producing undefined behavior in fence completion writes.
Attack Vector
Exploitation requires local access with the ability to open /dev/dri/renderD* or /dev/dri/card* device nodes and issue DRM_IOCTL_AMDGPU_CS calls. A low-privileged user in the video or render group can construct a CS submission targeting a VCN v2.5 encode or decode ring with a user fence descriptor attached. No user interaction is required.
The vulnerability manifests when the driver processes the malformed submission. Rather than a synthetic exploit, refer to the upstream patch series listed in the Linux Kernel Commit references for the exact code path and validation logic that was added.
Detection Methods for CVE-2026-63855
Indicators of Compromise
- Unexpected kernel log entries from the amdgpu driver referencing VCN ring submissions, fence timeouts, or GPU resets on affected hardware.
- Local processes owned by non-root users repeatedly invoking DRM_IOCTL_AMDGPU_CS against VCN v2.5 encode or decode rings.
- User-space video processes crashing after submitting CS calls with attached user fences.
Detection Strategies
- Inventory running kernel versions against the fixed commits (2c6fb056, 4f317863, 5a3c6f76, 602d4c58, 8f0ea452) to identify unpatched hosts.
- Enable auditd rules that log ioctl invocations on /dev/dri/* device nodes and correlate with the process identity.
- Monitor dmesg for amdgpu driver warnings, fence lockups, or repeated GPU ring recovery events.
Monitoring Recommendations
- Forward kernel logs and audit records to a centralized SIEM for correlation across the Linux fleet.
- Baseline normal VCN ring usage per host so anomalous CS submission volume can be identified.
- Track container and VM workloads that pass through the AMD GPU render node, since containerized processes inherit the local attack surface.
How to Mitigate CVE-2026-63855
Immediate Actions Required
- Update the Linux kernel to a stable release that includes one of the referenced fix commits for the amdgpu VCN v2.5 driver.
- Restrict membership in the video and render groups so only trusted local accounts can access /dev/dri/* device nodes.
- Rebuild and redeploy custom kernels or vendor-supplied kernels that backport the fix.
Patch Information
The issue is fixed by setting no_user_fence for VCN v2.5 encoder and decoder rings, causing the CS path to reject submissions containing user fences. The change is cherry-picked from upstream commit efc9dd5590894109bce9a0bfe1fa5592dd6b20b1 and available in stable trees via commits 2c6fb056, 4f317863, 5a3c6f76, 602d4c58, and 8f0ea452. Apply the distribution kernel update that carries these commits.
Workarounds
- Deny non-essential local users access to /dev/dri/renderD* nodes by adjusting group permissions on affected hosts.
- Disable hardware-accelerated video encode and decode on AMD GPUs where the workload does not require VCN functionality.
- Constrain untrusted containers so they do not receive access to the host GPU device nodes.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
