Executive brief
A vulnerability was identified in the Linux kernel's AMD GPU driver affecting systems with VCN 3.0 hardware. The video encoding and decoding components were incorrectly allowing certain memory synchronization requests (user fences) that the hardware does not actually support. This could lead to unpredictable system behavior or stability issues when processing video data.
Technical details
A vulnerability in the 'amdgpu' driver within the Linux kernel stems from the VCN (Video Core Next) v3.0 encoder and decoder rings incorrectly handling 64-bit user fence writes. The hardware does not support these operations, but the driver previously did not explicitly block them during Command Submission (CS). An attacker with local access could potentially exploit this to cause undefined behavior or kernel instability by submitting CS requests with user fences. The fix involves setting the 'no_user_fence' flag to true for VCN v3.0 rings to ensure such submissions are rejected.
Affected products
- Linux Linux 5.9 to 7.0.10
Timeline
- 2026-07-19: disclosed
- 2026-07-19: advisory
References
- https://git.kernel.org/stable/c/26c4f38529ac78930c9c4713e16ebc5b689bb0a3
- https://git.kernel.org/stable/c/2d6525e7b2504f5bbfe9417cddc1e8da858791dd
- https://git.kernel.org/stable/c/b076e45e6f757a2829e80d0144c1b5f201bee5af
- https://git.kernel.org/stable/c/e74fc9c72c1ba78d0de0b849f5929c3b39a8e20c
- https://git.kernel.org/stable/c/f1e5a6660d7cbf006079126d9babbf0ccf538c6b