CVE-2026-63853 - Vulnerability Details

- drm/amdgpu/vcn: set no_user_fence for VCN v4.0 enc ring

Description

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu/vcn: set no_user_fence for VCN v4.0 enc ring

VCN encoder and decoder rings do not support 64-bit user fence writes,
reject CS submissions with user fences.

(cherry picked from commit fd852c048b46f9825e904a4f3f4538fe9d8827d9)

Published: 2026-07-19

Score: 7.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A Linux kernel defect in the AMDGPU Virtual Codec Engine (VCN) board limits the handling of 64‑bit user fence writes. The kernel incorrectly rejects command streams that include such fences for the VCN v4.0 encoder and decoder rings, causing the driver to fail to process the submission and potentially disabling GPU functionality. This results in a denial of service for GPU operations. The weakness is identified as CWE‑1287 and CWE‑20.

Affected Systems

All Linux kernel versions that ship the AMDGPU driver with support for the VCN v4.0 encoder and decoder rings are affected. The issue is confined to AMD GPU hardware and GPU drivers; other hardware are not impacted.

Risk and Exploitability

The CVSS score of 7.8 indicates a high severity. The EPSS score of <1% suggests that exploitation is currently unlikely. The vulnerability is not listed in the CISA KEV. The likely attack vector is local, where a user with access to the GPU device can submit command streams that trigger the failure. This inference is not explicitly stated in the CVE data. No remote or privilege‑escapable exploitation is described.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`8da1170a16e4d4b49fa07d1f75ad480847ff7eca`	affected	< 525cc9df654365c147ae61e5562cf599ea2257f7
`8da1170a16e4d4b49fa07d1f75ad480847ff7eca`	affected	< d8df8918677136b018d71d0b94a1f6b816715946
`8da1170a16e4d4b49fa07d1f75ad480847ff7eca`	affected	< 1286b6872de0aee1feeeaa6dbac86369806de9a5
`8da1170a16e4d4b49fa07d1f75ad480847ff7eca`	affected	< 6bdd2ed6458d35c368fbe9550a4d7f342abd3a92
`8da1170a16e4d4b49fa07d1f75ad480847ff7eca`	affected	< 51f694221047c84fa185be98210eb2c354ffb8c6

Linux

affected

Version	Status	Constraints
`5.19`	affected	—
`0`	unaffected	< 5.19
`6.6.160`	unaffected	≤ 6.6.*
`6.12.114`	unaffected	≤ 6.12.*
`6.18.33`	unaffected	≤ 6.18.*
`7.0.10`	unaffected	≤ 7.0.*
`7.1`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel:7.1:rc1::::::

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[8da1170a16e4d4b49fa07d1f75ad480847ff7eca,1286b6872de0aee1feeeaa6dbac86369806de9a5)`	affected	code_commit	—
`[8da1170a16e4d4b49fa07d1f75ad480847ff7eca,6bdd2ed6458d35c368fbe9550a4d7f342abd3a92)`	affected	code_commit	—
`[8da1170a16e4d4b49fa07d1f75ad480847ff7eca,51f694221047c84fa185be98210eb2c354ffb8c6)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`5.19`	affected	generic	—
`[0,5.19)`	unaffected	generic	—
`[6.18.33,7.0.0)`	unaffected	semver	—
`[7.0.10,7.1.0)`	unaffected	semver	—
`[7.1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the Linux kernel to a version that includes the commit adding the no_user_fence handling for VCN v4.0 rings, or apply the specific patch to a custom kernel build.
If a kernel update is not immediately available, restrict VCN v4.0 usage by disabling the encoder/decoder rings through driver configuration or by enabling the no_user_fence setting if supported.
Monitor system logs for errors related to rejected command streams and ensure GPU services remain operational after any changes.

Generated by OpenCVE AI on October 27, 2026 at 01:42 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Ubuntu USN	USN-8593-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8603-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8618-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8663-1	Linux kernel (NVIDIA) vulnerabilities
Ubuntu USN	USN-8664-1	Linux kernel (NVIDIA BaseOS) vulnerabilities
Ubuntu USN	USN-8728-1	Linux kernel (GCP) vulnerabilities
Ubuntu USN	USN-8781-1	Linux kernel (NVIDIA Tegra) vulnerabilities
Ubuntu USN	USN-8728-2	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8728-3	Linux kernel (Oracle) vulnerabilities

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00175.

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://git.kernel.org/stable/c/1286b6872de0aee1feeeaa6dbac86369806de9a5
https://git.kernel.org/stable/c/51f694221047c84fa185be98210eb2c354ffb8c6
https://git.kernel.org/stable/c/525cc9df654365c147ae61e5562cf599ea2257f7
https://git.kernel.org/stable/c/6bdd2ed6458d35c368fbe9550a4d7f342abd3a92
https://git.kernel.org/stable/c/d8df8918677136b018d71d0b94a1f6b816715946
https://lore.kernel.org/linux-cve-announce/2026071932-CVE-2026-63853-ad90@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-63853
https://www.cve.org/CVERecord?id=CVE-2026-63853

History

Mon, 26 Oct 2026 20:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		NVD-CWE-noinfo
CPEs		cpe:2.3:o:linux:linux_kernel:7.1:rc1::::::

Wed, 21 Oct 2026 17:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Wed, 21 Oct 2026 13:00:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/525cc9df654365c147ae61e5562cf599ea2257f7 https://git.kernel.org/stable/c/d8df8918677136b018d71d0b94a1f6b816715946

Mon, 19 Oct 2026 20:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-20

Tue, 21 Jul 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-1287
References		https://lore.kernel.org/linux-cve-announce/2026071932-CVE-2026-63853-ad90@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-63853 https://www.cve.org/CVERecord?id=CVE-2026-63853
Metrics	threat_severity `None`	threat_severity `Low`

Mon, 20 Jul 2026 14:45:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Sun, 19 Jul 2026 14:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vcn: set no_user_fence for VCN v4.0 enc ring VCN encoder and decoder rings do not support 64-bit user fence writes, reject CS submissions with user fences. (cherry picked from commit fd852c048b46f9825e904a4f3f4538fe9d8827d9)
Title		drm/amdgpu/vcn: set no_user_fence for VCN v4.0 enc ring
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/1286b6872de0aee1feeeaa6dbac86369806de9a5 https://git.kernel.org/stable/c/51f694221047c84fa185be98210eb2c354ffb8c6 https://git.kernel.org/stable/c/6bdd2ed6458d35c368fbe9550a4d7f342abd3a92

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-07-19T14:04:43.885Z

Updated: 2026-10-21T12:42:40.394Z

Reserved: 2026-07-19T07:54:57.016Z

Link: CVE-2026-63853

Vulnrichment

Updated: 2026-10-16T15:32:18.476Z

NVD

Status : Analyzed

Published: 2026-07-19T15:16:52.113

Modified: 2026-10-26T20:02:56.690

Link: CVE-2026-63853

Redhat

Severity : Low

Publid Date: 2026-07-19T00:00:00Z

Links: CVE-2026-63853 - Bugzilla

OpenCVE Enrichment

Updated: 2026-10-27T01:45:13Z

Weaknesses

CWE-1287
Improper Validation of Specified Type of Input
CWE-20
Improper Input Validation
NVD-CWE-noinfo

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Exploitation none

Automatable no

Technical Impact total

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object