Executive brief
A vulnerability was identified in the Linux kernel's AMD GPU driver specifically affecting JPEG decoding hardware. The system was incorrectly allowing certain memory synchronization requests (user fences) that the hardware does not actually support. This could lead to unpredictable system behavior or stability issues when processing video or image data.
Technical details
A vulnerability in the amdgpu driver's JPEG v5.0.1 implementation (drivers/gpu/drm/amd/amdgpu/jpeg_v5_0_1.c) allowed Command Submission (CS) with user fences despite the hardware lacking support for 64-bit user fence writes. This is resolved by setting the 'no_user_fence' flag to true for the JPEG v5.0.1 ring functions, ensuring the kernel rejects such submissions. An attacker with local access to GPU resources could potentially trigger undefined behavior or kernel instability. Patches have been backported to various stable branches including 6.18.33 and 7.0.10.
Affected products
- Linux Linux Kernel 6.14 to 6.18.33, 7.0.10
Timeline
- 2026-04-27: other: Initial fix authored
- 2026-07-19: disclosed: CVE published