Executive brief
A vulnerability was identified in the Linux kernel's AMD GPU driver affecting systems with JPEG v5.0.0 hardware. The issue involves the driver incorrectly allowing certain command submissions that the hardware cannot safely process, which could lead to system instability or crashes. This has been resolved by ensuring the driver rejects these unsupported requests.
Technical details
A vulnerability in the 'amdgpu' driver within the Linux kernel stems from the JPEG v5.0.0 ring buffer's lack of support for 64-bit user fence writes. Prior to the fix, the driver did not explicitly reject Command Stream (CS) submissions containing these fences. An attacker with local access to the GPU interface could potentially trigger hardware errors or kernel instability by submitting malformed CS requests. The fix involves setting the 'no_user_fence' flag to true in the 'jpeg_v5_0_0_dec_ring_vm_funcs' structure, forcing the driver to reject such submissions. Patches are available in stable kernel releases 6.12.91, 6.18.33, and 7.0.10.
Affected products
- Linux Linux Kernel 6.9 through 7.0.9
Timeline
- 2026-04-28: patched: Initial fix in mainline kernel tree
- 2026-07-19: disclosed: CVE published