CVE-2026-63855

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-63855", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-19T07:54:57.016Z", "datePublished": "2026-07-19T14:04:45.096Z", "dateUpdated": "2026-10-30T12:27:18.153Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:27:18.153Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu/vcn: set no_user_fence for VCN v2.5 enc/dec rings\n\nVCN encoder and decoder rings do not support 64-bit user fence writes,\nreject CS submissions with user fences.\n\n(cherry picked from commit efc9dd5590894109bce9a0bfe1fa5592dd6b20b1)"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerability is reached only through the local DRM_AMDGPU_CS ioctl on a /dev/dri/renderD* node; there is no network, Bluetooth, or physical-access attack path to the VCN command submission code.\nAC:L - On affected AMD Instinct MI100 systems, an attacker with render-node access can reliably submit a VCN enc/dec command buffer with a user-fence chunk using standard libdrm/amdgpu APIs, triggering the malformed 64-bit fence write without races or victim-dependent timing.\nPR:L - Exploitation requires opening the DRM render node and submitting GPU commands, which needs only local user privileges (typically membership in the render/video group) on multi-tenant GPU cloud instances, workstations, or containers with GPU access\u2014not root or capabilities obtainable only in the init namespace.\nUI:N - No victim interaction is required; the attacker directly crafts and submits the malicious command submission through the render node without needing another user to open files, mount filesystems, or perform any action.\nS:U - The misdirected GPU fence write corrupts memory within the attacker's own GPU virtual address space on the assigned device; it does not cross a VM, container, or IOMMU security boundary to affect another security authority.\nC:H - The bug causes GPU-initiated writes to an incorrectly decoded address, constituting out-of-bounds memory corruption that can be leveraged to read adjacent GPU-mapped buffers and disclose sensitive data from the attacker's or co-resident GPU allocations.\nI:H - The hardware fence completion write is an attacker-controlled 64-bit store to a mis-decoded GPU virtual address, providing an arbitrary GPU memory write primitive that could corrupt kernel-visible GTT mappings or GPU state for further exploitation.\nA:H - Misdirected fence writes to unmapped or invalid GPU addresses can cause GPU faults, engine hangs, or full GPU resets that deny video codec and compute service on the affected accelerator."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/amd/amdgpu/vcn_v2_5.c"], "versions": [{"version": "28c17d72072b7ce5cc13a527dcbfc045cc995e7d", "lessThan": "8156e258025f2a22fcf7486c96848ac3cd3541dd", "status": "affected", "versionType": "git"}, {"version": "28c17d72072b7ce5cc13a527dcbfc045cc995e7d", "lessThan": "2c6fb056567efb49f8674108b86088a1cfaa86d0", "status": "affected", "versionType": "git"}, {"version": "28c17d72072b7ce5cc13a527dcbfc045cc995e7d", "lessThan": "8f0ea4524dc71c6c9ec97f2711f46e12f624140f", "status": "affected", "versionType": "git"}, {"version": "28c17d72072b7ce5cc13a527dcbfc045cc995e7d", "lessThan": "602d4c5872b25ddd4d82fb2025efb9a05b187bb3", "status": "affected", "versionType": "git"}, {"version": "28c17d72072b7ce5cc13a527dcbfc045cc995e7d", "lessThan": "5a3c6f76cab164a5d803084908d7050f649ab7f9", "status": "affected", "versionType": "git"}, {"version": "28c17d72072b7ce5cc13a527dcbfc045cc995e7d", "lessThan": "4f317863a3ab212a027d8c8c3cc3af4e3fb95704", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/amd/amdgpu/vcn_v2_5.c"], "versions": [{"version": "5.4", "status": "affected"}, {"version": "0", "lessThan": "5.4", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.191", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.141", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.91", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.33", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0.10", "lessThanOrEqual": "7.0.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.4", "versionEndExcluding": "6.1.191"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.4", "versionEndExcluding": "6.6.141"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.4", "versionEndExcluding": "6.12.91"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.4", "versionEndExcluding": "6.18.33"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.4", "versionEndExcluding": "7.0.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.4", "versionEndExcluding": "7.1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/8156e258025f2a22fcf7486c96848ac3cd3541dd"}, {"url": "https://git.kernel.org/stable/c/2c6fb056567efb49f8674108b86088a1cfaa86d0"}, {"url": "https://git.kernel.org/stable/c/8f0ea4524dc71c6c9ec97f2711f46e12f624140f"}, {"url": "https://git.kernel.org/stable/c/602d4c5872b25ddd4d82fb2025efb9a05b187bb3"}, {"url": "https://git.kernel.org/stable/c/5a3c6f76cab164a5d803084908d7050f649ab7f9"}, {"url": "https://git.kernel.org/stable/c/4f317863a3ab212a027d8c8c3cc3af4e3fb95704"}], "title": "drm/amdgpu/vcn: set no_user_fence for VCN v2.5 enc/dec rings", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-63855", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T15:32:22.667512Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-20", "description": "CWE-20 Improper Input Validation"}]}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-19T20:07:51.946Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-63855", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T15:32:22.667512Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-20", "description": "CWE-20 Improper Input Validation"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T15:32:23.245Z"}}], "cna": {"title": "drm/amdgpu/vcn: set no_user_fence for VCN v2.5 enc/dec rings", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerability is reached only through the local DRM_AMDGPU_CS ioctl on a /dev/dri/renderD* node; there is no network, Bluetooth, or physical-access attack path to the VCN command submission code.\nAC:L - On affected AMD Instinct MI100 systems, an attacker with render-node access can reliably submit a VCN enc/dec command buffer with a user-fence chunk using standard libdrm/amdgpu APIs, triggering the malformed 64-bit fence write without races or victim-dependent timing.\nPR:L - Exploitation requires opening the DRM render node and submitting GPU commands, which needs only local user privileges (typically membership in the render/video group) on multi-tenant GPU cloud instances, workstations, or containers with GPU access\u2014not root or capabilities obtainable only in the init namespace.\nUI:N - No victim interaction is required; the attacker directly crafts and submits the malicious command submission through the render node without needing another user to open files, mount filesystems, or perform any action.\nS:U - The misdirected GPU fence write corrupts memory within the attacker's own GPU virtual address space on the assigned device; it does not cross a VM, container, or IOMMU security boundary to affect another security authority.\nC:H - The bug causes GPU-initiated writes to an incorrectly decoded address, constituting out-of-bounds memory corruption that can be leveraged to read adjacent GPU-mapped buffers and disclose sensitive data from the attacker's or co-resident GPU allocations.\nI:H - The hardware fence completion write is an attacker-controlled 64-bit store to a mis-decoded GPU virtual address, providing an arbitrary GPU memory write primitive that could corrupt kernel-visible GTT mappings or GPU state for further exploitation.\nA:H - Misdirected fence writes to unmapped or invalid GPU addresses can cause GPU faults, engine hangs, or full GPU resets that deny video codec and compute service on the affected accelerator."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "28c17d72072b7ce5cc13a527dcbfc045cc995e7d", "lessThan": "2c6fb056567efb49f8674108b86088a1cfaa86d0", "versionType": "git"}, {"status": "affected", "version": "28c17d72072b7ce5cc13a527dcbfc045cc995e7d", "lessThan": "8f0ea4524dc71c6c9ec97f2711f46e12f624140f", "versionType": "git"}, {"status": "affected", "version": "28c17d72072b7ce5cc13a527dcbfc045cc995e7d", "lessThan": "602d4c5872b25ddd4d82fb2025efb9a05b187bb3", "versionType": "git"}, {"status": "affected", "version": "28c17d72072b7ce5cc13a527dcbfc045cc995e7d", "lessThan": "5a3c6f76cab164a5d803084908d7050f649ab7f9", "versionType": "git"}, {"status": "affected", "version": "28c17d72072b7ce5cc13a527dcbfc045cc995e7d", "lessThan": "4f317863a3ab212a027d8c8c3cc3af4e3fb95704", "versionType": "git"}], "programFiles": ["drivers/gpu/drm/amd/amdgpu/vcn_v2_5.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.4"}, {"status": "unaffected", "version": "0", "lessThan": "5.4", "versionType": "semver"}, {"status": "unaffected", "version": "6.6.141", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.91", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.33", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.0.10", "versionType": "semver", "lessThanOrEqual": "7.0.*"}, {"status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/gpu/drm/amd/amdgpu/vcn_v2_5.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/2c6fb056567efb49f8674108b86088a1cfaa86d0"}, {"url": "https://git.kernel.org/stable/c/8f0ea4524dc71c6c9ec97f2711f46e12f624140f"}, {"url": "https://git.kernel.org/stable/c/602d4c5872b25ddd4d82fb2025efb9a05b187bb3"}, {"url": "https://git.kernel.org/stable/c/5a3c6f76cab164a5d803084908d7050f649ab7f9"}, {"url": "https://git.kernel.org/stable/c/4f317863a3ab212a027d8c8c3cc3af4e3fb95704"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu/vcn: set no_user_fence for VCN v2.5 enc/dec rings\n\nVCN encoder and decoder rings do not support 64-bit user fence writes,\nreject CS submissions with user fences.\n\n(cherry picked from commit efc9dd5590894109bce9a0bfe1fa5592dd6b20b1)"}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.141", "versionStartIncluding": "5.4"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.91", "versionStartIncluding": "5.4"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.33", "versionStartIncluding": "5.4"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.0.10", "versionStartIncluding": "5.4"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.1", "versionStartIncluding": "5.4"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:36:33.839Z"}}}, "cveMetadata": {"cveId": "CVE-2026-63855", "state": "PUBLISHED", "dateUpdated": "2026-10-19T20:07:51.946Z", "dateReserved": "2026-07-19T07:54:57.016Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-07-19T14:04:45.096Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/gpu/drm/amd/amdgpu/vcn_v2_5.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "8156e258025f2a22fcf7486c96848ac3cd3541dd", "status": "affected", "version": "28c17d72072b7ce5cc13a527dcbfc045cc995e7d", "versionType": "git"}, {"lessThan": "2c6fb056567efb49f8674108b86088a1cfaa86d0", "status": "affected", "version": "28c17d72072b7ce5cc13a527dcbfc045cc995e7d", "versionType": "git"}, {"lessThan": "8f0ea4524dc71c6c9ec97f2711f46e12f624140f", "status": "affected", "version": "28c17d72072b7ce5cc13a527dcbfc045cc995e7d", "versionType": "git"}, {"lessThan": "602d4c5872b25ddd4d82fb2025efb9a05b187bb3", "status": "affected", "version": "28c17d72072b7ce5cc13a527dcbfc045cc995e7d", "versionType": "git"}, {"lessThan": "5a3c6f76cab164a5d803084908d7050f649ab7f9", "status": "affected", "version": "28c17d72072b7ce5cc13a527dcbfc045cc995e7d", "versionType": "git"}, {"lessThan": "4f317863a3ab212a027d8c8c3cc3af4e3fb95704", "status": "affected", "version": "28c17d72072b7ce5cc13a527dcbfc045cc995e7d", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/gpu/drm/amd/amdgpu/vcn_v2_5.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.4"}, {"lessThan": "5.4", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.191", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.141", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.91", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.33", "versionType": "semver"}, {"lessThanOrEqual": "7.0.*", "status": "unaffected", "version": "7.0.10", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "E449CE3F-57B1-4CEA-A6E9-266280AEA122", "versionEndExcluding": "6.6.141", "versionStartIncluding": "5.4", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "C918746B-DE6F-448F-A93E-A04C5481688D", "versionEndExcluding": "6.12.91", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "96D99E49-380D-43AB-BDBA-25C3AD018A9C", "versionEndExcluding": "6.18.33", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "A13475D2-59BF-4716-94B5-7C1D239A2CF4", "versionEndExcluding": "7.0.10", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*", "matchCriteriaId": "B1EF7059-E670-45F4-B422-54C40FA86390", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu/vcn: set no_user_fence for VCN v2.5 enc/dec rings\n\nVCN encoder and decoder rings do not support 64-bit user fence writes,\nreject CS submissions with user fences.\n\n(cherry picked from commit efc9dd5590894109bce9a0bfe1fa5592dd6b20b1)"}], "id": "CVE-2026-63855", "lastModified": "2026-10-30T13:19:21.533", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-63855", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T15:32:22.667512Z", "version": "2.0.3"}}]}, "published": "2026-07-19T15:16:52.337", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/2c6fb056567efb49f8674108b86088a1cfaa86d0"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/4f317863a3ab212a027d8c8c3cc3af4e3fb95704"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/5a3c6f76cab164a5d803084908d7050f649ab7f9"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/602d4c5872b25ddd4d82fb2025efb9a05b187bb3"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/8156e258025f2a22fcf7486c96848ac3cd3541dd"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/8f0ea4524dc71c6c9ec97f2711f46e12f624140f"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-20"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "kernel: drm/amdgpu/vcn: set no_user_fence for VCN v2.5 enc/dec rings", "id": "2502300", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502300"}, "csaw": false, "cwe": "CWE-1287", "details": ["In the Linux kernel, the following vulnerability has been resolved:\ndrm/amdgpu/vcn: set no_user_fence for VCN v2.5 enc/dec rings\nVCN encoder and decoder rings do not support 64-bit user fence writes,\nreject CS submissions with user fences.\n(cherry picked from commit efc9dd5590894109bce9a0bfe1fa5592dd6b20b1)", "A flaw was found in the Linux kernel's AMDGPU Video Core Next (VCN) driver. The VCN encoder and decoder rings do not support 64-bit user fence writes. A local attacker could exploit this by submitting commands with unsupported 64-bit user fences, which could lead to system instability or a denial of service (DoS)."], "name": "CVE-2026-63855", "public_date": "2026-07-19T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-63855\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-63855\nhttps://lore.kernel.org/linux-cve-announce/2026071932-CVE-2026-63855-c40e@gregkh/T"]}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[28c17d72072b7ce5cc13a527dcbfc045cc995e7d,2c6fb056567efb49f8674108b86088a1cfaa86d0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[28c17d72072b7ce5cc13a527dcbfc045cc995e7d,8f0ea4524dc71c6c9ec97f2711f46e12f624140f)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[28c17d72072b7ce5cc13a527dcbfc045cc995e7d,602d4c5872b25ddd4d82fb2025efb9a05b187bb3)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[28c17d72072b7ce5cc13a527dcbfc045cc995e7d,5a3c6f76cab164a5d803084908d7050f649ab7f9)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[28c17d72072b7ce5cc13a527dcbfc045cc995e7d,4f317863a3ab212a027d8c8c3cc3af4e3fb95704)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "5.4"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,5.4)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.141,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.91,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.33,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.0.10,7.1.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-07-21T05:00:11.666774+00:00", "updated": "2026-10-26T21:00:10.153536+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}