Executive brief
A vulnerability was identified in the Linux kernel's AMD GPU driver where certain video encoding and decoding components (VCN v2.0) incorrectly handled synchronization signals known as user fences. This could potentially lead to system instability or memory corruption when processing video data. The issue has been resolved by ensuring the driver rejects unsupported synchronization requests.
Technical details
The vulnerability exists within the 'amdgpu' driver's VCN (Video Core Next) v2.0 implementation. Specifically, the VCN encoder and decoder rings do not support 64-bit user fence writes. Without the 'no_user_fence' flag set, the driver might attempt to process Command Stream (CS) submissions containing user fences, leading to undefined behavior or hardware hangs. The fix involves setting the 'no_user_fence' attribute to true for VCN v2.0 rings to ensure such submissions are rejected. This affects Linux kernel versions from 5.3 up to 7.1 (where it was patched in various stable branches).
Affected products
- Linux Linux Kernel 5.3 to 7.1
Timeline
- 2026-07-19: disclosed
- 2026-07-19: advisory
References
- https://git.kernel.org/stable/c/5e777bc4cbe928ac0fd95e368fee1540f2ce4db2
- https://git.kernel.org/stable/c/8d80b293b41fcb5e9396db93e788b0f4ebcbafb7
- https://git.kernel.org/stable/c/ac06ce5cac9e711281585d09d00c6efcd9b86396
- https://git.kernel.org/stable/c/c71aecae98e42dcf2baf462df50b3a2cf1a93fe4
- https://git.kernel.org/stable/c/f264019be80de79f84f464846451445923bffea0