Executive brief
A vulnerability was identified in the Linux kernel's AMD GPU driver affecting systems with VCN 5.0.0 hardware. The graphics driver incorrectly allowed certain command submissions that the hardware could not safely process, potentially leading to system instability or crashes. This issue has been resolved by ensuring the driver rejects unsupported 64-bit user fence requests.
Technical details
A vulnerability in the 'amdgpu' driver within the Linux kernel stemmed from the VCN (Video Core Next) v5.0.0 encoder and decoder rings incorrectly accepting 64-bit user fence writes. Because the hardware does not support these operations, processing such Command Submission (CS) requests could lead to kernel instability or memory corruption. The fix involves setting the 'no_user_fence' flag to true in the 'vcn_v5_0_0_unified_ring_vm_funcs' structure, forcing the driver to reject CS submissions that include user fences. This is a local vulnerability requiring the ability to submit commands to the GPU.
Affected products
- Linux Linux 6.9 to 7.0.10
Timeline
- 2026-07-19: disclosed
- 2026-07-19: advisory