CVE-2026-63856

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-63856", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-19T07:54:57.016Z", "datePublished": "2026-07-19T14:04:45.716Z", "dateUpdated": "2026-10-30T12:27:19.219Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:27:19.219Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu/vcn: set no_user_fence for VCN v2.0 enc/dec rings\n\nVCN encoder and decoder rings do not support 64-bit user fence writes,\nreject CS submissions with user fences.\n\n(cherry picked from commit e2b5499fca55f1a32960a311bbb62e35891eaf73)"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - Exploitation requires submitting a crafted AMDGPU_CS ioctl to a local DRM render node (/dev/dri/renderD*); the vulnerable VCN v2.0 path is not reachable over the network.\nAC:L - An attacker with render-node access can reliably submit a VCN DEC/ENC command stream with an AMDGPU_CHUNK_ID_FENCE user-fence chunk; no race or victim-specific timing is required beyond having a VCN 2.0-capable AMDGPU.\nPR:L - Any unprivileged local user who can open the DRM render node (typical render-group membership on Linux desktops, or any app granted GPU access on RDNA1 systems) can trigger the bug without root or capabilities.\nUI:N - No victim interaction is needed; the attacker directly crafts and submits the malicious command submission via the AMDGPU DRM ioctl interface.\nS:U - The misdirected GPU fence write is constrained to the attacker's own GPU virtual address space via per-process amdgpu_vm page tables; impact remains within the same kernel/OS security authority, not a VM-guest-to-host or IOMMU-boundary escape.\nC:H - The unsupported 64-bit user fence causes the VCN engine to perform a misdirected GPU memory write (40-bit address truncation on the decoder ring), which is memory corruption that can be leveraged to corrupt adjacent GPU buffers and disclose their prior contents when read back.\nI:H - The VCN hardware performs a GPU-initiated write of the fence sequence to a potentially mis-targeted GPU virtual address, providing a memory-corruption write primitive within the submitter's GPU mappings that could be chained for further exploitation.\nA:H - Submitting an unsupported user fence to VCN rings can hang the video engine or trigger a GPU fault/reset (amdgpu_gpu_reset), denying GPU service to all local consumers including the display stack."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/amd/amdgpu/vcn_v2_0.c"], "versions": [{"version": "1b61de45dfaff00b627e47349a019658e39268b9", "lessThan": "bcb972496f189edbf56a18b14f9b4831fd127ab8", "status": "affected", "versionType": "git"}, {"version": "1b61de45dfaff00b627e47349a019658e39268b9", "lessThan": "f264019be80de79f84f464846451445923bffea0", "status": "affected", "versionType": "git"}, {"version": "1b61de45dfaff00b627e47349a019658e39268b9", "lessThan": "5e777bc4cbe928ac0fd95e368fee1540f2ce4db2", "status": "affected", "versionType": "git"}, {"version": "1b61de45dfaff00b627e47349a019658e39268b9", "lessThan": "ac06ce5cac9e711281585d09d00c6efcd9b86396", "status": "affected", "versionType": "git"}, {"version": "1b61de45dfaff00b627e47349a019658e39268b9", "lessThan": "c71aecae98e42dcf2baf462df50b3a2cf1a93fe4", "status": "affected", "versionType": "git"}, {"version": "1b61de45dfaff00b627e47349a019658e39268b9", "lessThan": "8d80b293b41fcb5e9396db93e788b0f4ebcbafb7", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/amd/amdgpu/vcn_v2_0.c"], "versions": [{"version": "5.3", "status": "affected"}, {"version": "0", "lessThan": "5.3", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.191", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.141", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.91", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.33", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0.10", "lessThanOrEqual": "7.0.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.3", "versionEndExcluding": "6.1.191"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.3", "versionEndExcluding": "6.6.141"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.3", "versionEndExcluding": "6.12.91"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.3", "versionEndExcluding": "6.18.33"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.3", "versionEndExcluding": "7.0.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.3", "versionEndExcluding": "7.1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/bcb972496f189edbf56a18b14f9b4831fd127ab8"}, {"url": "https://git.kernel.org/stable/c/f264019be80de79f84f464846451445923bffea0"}, {"url": "https://git.kernel.org/stable/c/5e777bc4cbe928ac0fd95e368fee1540f2ce4db2"}, {"url": "https://git.kernel.org/stable/c/ac06ce5cac9e711281585d09d00c6efcd9b86396"}, {"url": "https://git.kernel.org/stable/c/c71aecae98e42dcf2baf462df50b3a2cf1a93fe4"}, {"url": "https://git.kernel.org/stable/c/8d80b293b41fcb5e9396db93e788b0f4ebcbafb7"}], "title": "drm/amdgpu/vcn: set no_user_fence for VCN v2.0 enc/dec rings", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-63856", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T15:32:25.121168Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-20", "description": "CWE-20 Improper Input Validation"}]}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-19T20:07:52.084Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-63856", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T15:32:25.121168Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T15:32:25.718Z"}}], "cna": {"title": "drm/amdgpu/vcn: set no_user_fence for VCN v2.0 enc/dec rings", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - Exploitation requires submitting a crafted AMDGPU_CS ioctl to a local DRM render node (/dev/dri/renderD*); the vulnerable VCN v2.0 path is not reachable over the network.\nAC:L - An attacker with render-node access can reliably submit a VCN DEC/ENC command stream with an AMDGPU_CHUNK_ID_FENCE user-fence chunk; no race or victim-specific timing is required beyond having a VCN 2.0-capable AMDGPU.\nPR:L - Any unprivileged local user who can open the DRM render node (typical render-group membership on Linux desktops, or any app granted GPU access on RDNA1 systems) can trigger the bug without root or capabilities.\nUI:N - No victim interaction is needed; the attacker directly crafts and submits the malicious command submission via the AMDGPU DRM ioctl interface.\nS:U - The misdirected GPU fence write is constrained to the attacker's own GPU virtual address space via per-process amdgpu_vm page tables; impact remains within the same kernel/OS security authority, not a VM-guest-to-host or IOMMU-boundary escape.\nC:H - The unsupported 64-bit user fence causes the VCN engine to perform a misdirected GPU memory write (40-bit address truncation on the decoder ring), which is memory corruption that can be leveraged to corrupt adjacent GPU buffers and disclose their prior contents when read back.\nI:H - The VCN hardware performs a GPU-initiated write of the fence sequence to a potentially mis-targeted GPU virtual address, providing a memory-corruption write primitive within the submitter's GPU mappings that could be chained for further exploitation.\nA:H - Submitting an unsupported user fence to VCN rings can hang the video engine or trigger a GPU fault/reset (amdgpu_gpu_reset), denying GPU service to all local consumers including the display stack."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "1b61de45dfaff00b627e47349a019658e39268b9", "lessThan": "f264019be80de79f84f464846451445923bffea0", "versionType": "git"}, {"status": "affected", "version": "1b61de45dfaff00b627e47349a019658e39268b9", "lessThan": "5e777bc4cbe928ac0fd95e368fee1540f2ce4db2", "versionType": "git"}, {"status": "affected", "version": "1b61de45dfaff00b627e47349a019658e39268b9", "lessThan": "ac06ce5cac9e711281585d09d00c6efcd9b86396", "versionType": "git"}, {"status": "affected", "version": "1b61de45dfaff00b627e47349a019658e39268b9", "lessThan": "c71aecae98e42dcf2baf462df50b3a2cf1a93fe4", "versionType": "git"}, {"status": "affected", "version": "1b61de45dfaff00b627e47349a019658e39268b9", "lessThan": "8d80b293b41fcb5e9396db93e788b0f4ebcbafb7", "versionType": "git"}], "programFiles": ["drivers/gpu/drm/amd/amdgpu/vcn_v2_0.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.3"}, {"status": "unaffected", "version": "0", "lessThan": "5.3", "versionType": "semver"}, {"status": "unaffected", "version": "6.6.141", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.91", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.33", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.0.10", "versionType": "semver", "lessThanOrEqual": "7.0.*"}, {"status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/gpu/drm/amd/amdgpu/vcn_v2_0.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/f264019be80de79f84f464846451445923bffea0"}, {"url": "https://git.kernel.org/stable/c/5e777bc4cbe928ac0fd95e368fee1540f2ce4db2"}, {"url": "https://git.kernel.org/stable/c/ac06ce5cac9e711281585d09d00c6efcd9b86396"}, {"url": "https://git.kernel.org/stable/c/c71aecae98e42dcf2baf462df50b3a2cf1a93fe4"}, {"url": "https://git.kernel.org/stable/c/8d80b293b41fcb5e9396db93e788b0f4ebcbafb7"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu/vcn: set no_user_fence for VCN v2.0 enc/dec rings\n\nVCN encoder and decoder rings do not support 64-bit user fence writes,\nreject CS submissions with user fences.\n\n(cherry picked from commit e2b5499fca55f1a32960a311bbb62e35891eaf73)"}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.141", "versionStartIncluding": "5.3"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.91", "versionStartIncluding": "5.3"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.33", "versionStartIncluding": "5.3"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.0.10", "versionStartIncluding": "5.3"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.1", "versionStartIncluding": "5.3"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:36:34.905Z"}}}, "cveMetadata": {"cveId": "CVE-2026-63856", "state": "PUBLISHED", "dateUpdated": "2026-10-19T20:07:52.084Z", "dateReserved": "2026-07-19T07:54:57.016Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-07-19T14:04:45.716Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/gpu/drm/amd/amdgpu/vcn_v2_0.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "bcb972496f189edbf56a18b14f9b4831fd127ab8", "status": "affected", "version": "1b61de45dfaff00b627e47349a019658e39268b9", "versionType": "git"}, {"lessThan": "f264019be80de79f84f464846451445923bffea0", "status": "affected", "version": "1b61de45dfaff00b627e47349a019658e39268b9", "versionType": "git"}, {"lessThan": "5e777bc4cbe928ac0fd95e368fee1540f2ce4db2", "status": "affected", "version": "1b61de45dfaff00b627e47349a019658e39268b9", "versionType": "git"}, {"lessThan": "ac06ce5cac9e711281585d09d00c6efcd9b86396", "status": "affected", "version": "1b61de45dfaff00b627e47349a019658e39268b9", "versionType": "git"}, {"lessThan": "c71aecae98e42dcf2baf462df50b3a2cf1a93fe4", "status": "affected", "version": "1b61de45dfaff00b627e47349a019658e39268b9", "versionType": "git"}, {"lessThan": "8d80b293b41fcb5e9396db93e788b0f4ebcbafb7", "status": "affected", "version": "1b61de45dfaff00b627e47349a019658e39268b9", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/gpu/drm/amd/amdgpu/vcn_v2_0.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.3"}, {"lessThan": "5.3", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.191", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.141", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.91", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.33", "versionType": "semver"}, {"lessThanOrEqual": "7.0.*", "status": "unaffected", "version": "7.0.10", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "B7221768-9AEA-4427-9DA0-BBA41EF54B5D", "versionEndExcluding": "6.6.141", "versionStartIncluding": "5.3", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "C918746B-DE6F-448F-A93E-A04C5481688D", "versionEndExcluding": "6.12.91", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "96D99E49-380D-43AB-BDBA-25C3AD018A9C", "versionEndExcluding": "6.18.33", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "A13475D2-59BF-4716-94B5-7C1D239A2CF4", "versionEndExcluding": "7.0.10", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*", "matchCriteriaId": "B1EF7059-E670-45F4-B422-54C40FA86390", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu/vcn: set no_user_fence for VCN v2.0 enc/dec rings\n\nVCN encoder and decoder rings do not support 64-bit user fence writes,\nreject CS submissions with user fences.\n\n(cherry picked from commit e2b5499fca55f1a32960a311bbb62e35891eaf73)"}], "id": "CVE-2026-63856", "lastModified": "2026-10-30T13:19:22.100", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-63856", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T15:32:25.121168Z", "version": "2.0.3"}}]}, "published": "2026-07-19T15:16:52.440", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/5e777bc4cbe928ac0fd95e368fee1540f2ce4db2"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/8d80b293b41fcb5e9396db93e788b0f4ebcbafb7"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/ac06ce5cac9e711281585d09d00c6efcd9b86396"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/bcb972496f189edbf56a18b14f9b4831fd127ab8"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/c71aecae98e42dcf2baf462df50b3a2cf1a93fe4"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/f264019be80de79f84f464846451445923bffea0"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-20"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "kernel: drm/amdgpu/vcn: set no_user_fence for VCN v2.0 enc/dec rings", "id": "2502289", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502289"}, "csaw": false, "cwe": "CWE-617", "details": ["In the Linux kernel, the following vulnerability has been resolved:\ndrm/amdgpu/vcn: set no_user_fence for VCN v2.0 enc/dec rings\nVCN encoder and decoder rings do not support 64-bit user fence writes,\nreject CS submissions with user fences.\n(cherry picked from commit e2b5499fca55f1a32960a311bbb62e35891eaf73)", "A flaw was found in the Linux kernel's AMDGPU Video Core Next (VCN) 2.0 component. This vulnerability arises because the VCN encoder and decoder rings do not properly support 64-bit user fence writes. An attacker could exploit this by submitting command sequences with 64-bit user fences, leading to the rejection of these submissions and a denial of service for affected applications."], "name": "CVE-2026-63856", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-07-19T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-63856\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-63856\nhttps://lore.kernel.org/linux-cve-announce/2026071932-CVE-2026-63856-cac0@gregkh/T"]}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1b61de45dfaff00b627e47349a019658e39268b9,f264019be80de79f84f464846451445923bffea0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1b61de45dfaff00b627e47349a019658e39268b9,8d80b293b41fcb5e9396db93e788b0f4ebcbafb7)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1b61de45dfaff00b627e47349a019658e39268b9,ac06ce5cac9e711281585d09d00c6efcd9b86396)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1b61de45dfaff00b627e47349a019658e39268b9,c71aecae98e42dcf2baf462df50b3a2cf1a93fe4)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1b61de45dfaff00b627e47349a019658e39268b9,f264019be80de79f84f464846451445923bffea0)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "5.3"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,5.3)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.141,7.0.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.91,7.0.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.33,7.0.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.0.10,8.0.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,7.1]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-07-21T03:15:02.663231+00:00", "updated": "2026-10-27T02:15:13.814739+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}