CVE-2026-63841

A flaw was found in the Linux kernel's amdgpu graphics driver, specifically within the JPEG component. This vulnerability occurs because the JPEG rings do not correctly support 64-bit user fence writes. A local attacker could exploit this by submitting command requests with 64-bit user fences, causing the system to reject these submissions. This could lead to a denial of service or functional limitation for applications relying on the JPEG ring operations.

This vulnerability is rated as Moderate severity because exploitation requires local access with privileges to interact with the direct rendering manager (DRM) interface, limiting the attack surface to authenticated users on systems with specific AMD GPU hardware. Enterprise servers typically operate headlessly or without dedicated AMD graphics accelerators containing the affected JPEG v5.0.1 engine, significantly reducing practical exposure across standard Red Hat deployments. On systems where the hardware is present and accessible, an attacker could cause command stream rejections, resulting in a localized denial of service for media processing workflows rather than full system compromise or privilege escalation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.