Executive brief
A vulnerability was identified in the Linux kernel's AMD GPU driver specifically affecting JPEG video decoding components. The system was incorrectly allowing certain memory synchronization requests (user fences) that the hardware does not actually support. While primarily a stability and correctness fix, such issues in graphics drivers can sometimes be leveraged to cause system crashes or unpredictable behavior.
Technical details
A vulnerability in the amdgpu driver's JPEG v4.0.3 implementation allowed Command Submission (CS) with 64-bit user fences, despite the hardware ring not supporting these operations. This could lead to undefined behavior or memory corruption when the hardware attempts to execute unsupported fence writes. The fix involves setting the 'no_user_fence' flag to true for the JPEG v4.0.3 ring functions, ensuring the kernel rejects such submissions. The issue was introduced in the initial support for VCN4_0_3 and has been patched in multiple stable branches including 6.6.y, 6.12.y, 6.18.y, and 7.0.y.
Affected products
- Linux Linux Kernel 6.5 to 6.6.141, 6.12.91, 6.18.33, 7.0.10
Timeline
- 2026-07-19: disclosed
- 2026-07-19: advisory
References
- https://git.kernel.org/stable/c/249fa7549736de1c8e327d7ca6b32fa148a40bd6
- https://git.kernel.org/stable/c/83e37c0987ca92f9e87789b46dd311dcf5a4a6c8
- https://git.kernel.org/stable/c/8549b3933038e68dc61cb934b9a54223dd244a78
- https://git.kernel.org/stable/c/b884ff67d62ef514eee9d5f605c03101c8b6bc98
- https://git.kernel.org/stable/c/d6bd2a5fd611ec9c8a2411f084cff2435c709608