Executive brief
A vulnerability was identified in the Linux kernel's AMD GPU driver affecting systems with specific JPEG hardware (VCN 4.0.5). The hardware component does not support certain memory synchronization operations (64-bit user fences), which could lead to system instability or crashes if a program attempts to use them. This issue has been resolved by ensuring the driver rejects these unsupported requests.
Technical details
The vulnerability exists in the 'drm/amdgpu' driver, specifically within the JPEG v4.0.5 ring management. The hardware does not support 64-bit user fence writes; however, the driver previously allowed Command Submission (CS) requests that utilized these fences. An attacker with local access could potentially trigger undefined behavior or a kernel crash by submitting malformed CS requests. The fix involves setting the 'no_user_fence' flag to true for the JPEG v4.0.5 ring, causing the driver to explicitly reject such submissions. The issue was introduced in version 6.7 and patched in various stable branches including 6.12.x, 6.18.x, and 7.0.x.
Affected products
- Linux Linux Kernel 6.7 to 7.1
Timeline
- 2026-07-19: disclosed
- 2026-07-19: advisory