Executive brief
A vulnerability was identified in the Linux kernel's AMD GPU driver affecting systems with JPEG v3.0 hardware (such as Sienna Cichlid). The issue stems from the driver incorrectly allowing certain memory synchronization requests (user fences) that the hardware does not actually support. While rated as low impact, this could potentially lead to system instability or unexpected behavior when processing video data.
Technical details
In the Linux kernel's amdgpu driver, the JPEG v3.0 hardware implementation (found in drivers/gpu/drm/amd/amdgpu/jpeg_v3_0.c) failed to set the 'no_user_fence' flag. JPEG rings in this hardware version do not support 64-bit user fence writes. An attacker or malicious local process could submit Command Stream (CS) submissions with user fences, leading to undefined behavior or kernel instability because the hardware cannot process these requests. The fix involves explicitly setting '.no_user_fence = true' in the ring functions to reject such submissions.
Affected products
- Linux Linux Kernel 5.9 to 7.1
Timeline
- 2026-07-19: advisory
- 2026-07-19: disclosed
References
- https://git.kernel.org/stable/c/303da8279f195cc741adc52c1b44d6b64de63bb0
- https://git.kernel.org/stable/c/48ce00787e3fddd2b45692fc991b8ab128343da5
- https://git.kernel.org/stable/c/5ada37d7f736f9feeaa06a25e470a4c74e67a61a
- https://git.kernel.org/stable/c/a2baf12eec41f246689e6a3f8619af1200031576
- https://git.kernel.org/stable/c/ee035a9d3eed3a9f5a3e83c31a10b321c9598861