Executive brief
A vulnerability was identified in the Linux kernel's AMD GPU driver specifically affecting JPEG hardware acceleration. The driver incorrectly allowed certain synchronization requests (user fences) that the hardware does not support, which could lead to system instability or crashes when processing media. This issue has been resolved by ensuring the driver rejects these unsupported requests.
Technical details
The vulnerability exists within the 'amdgpu' driver's handling of JPEG v2.5 and v2.6 rings. The hardware does not support 64-bit user fence writes, but the driver previously failed to explicitly reject Command Submission (CS) requests containing them. This could lead to undefined behavior or kernel instability when a local user submits malformed or unsupported synchronization fences. The fix involves setting the 'no_user_fence' flag to true for the affected JPEG ring functions in 'drivers/gpu/drm/amd/amdgpu/jpeg_v2_5.c', ensuring such submissions are properly rejected.
Affected products
- Linux Linux Kernel 5.6 to 7.1
Timeline
- 2026-07-19: disclosed
- 2026-07-19: patched
References
- https://git.kernel.org/stable/c/3a96fee676fc0caf08f03ad915bec6fcd144d551
- https://git.kernel.org/stable/c/4d96e3cbfc66e4d66ea0096bde858e28ab62da00
- https://git.kernel.org/stable/c/63691e396105611173072ad548fc2b68831ecf23
- https://git.kernel.org/stable/c/694fe016969c5e5a24b9e0ef7c1307eedec8ddf8
- https://git.kernel.org/stable/c/79405e774ede411c6b47ed41c651e40b92de64a2