CVE-2026-63842

A flaw was found in the Linux kernel's AMD GPU JPEG driver. This vulnerability arises from the driver's inability to properly handle 64-bit user fence writes to its JPEG rings. A local user could exploit this by submitting specially crafted commands, potentially leading to system instability or a denial of service.

This vulnerability is rated as Moderate because exploitation is limited to local users who have access to the AMD graphics hardware interface and can submit command buffers, restricting the blast radius to a local denial of service. The flaw specifically impacts systems equipped with AMD GPUs utilizing JPEG v5.0 hardware blocks, meaning systems without supported AMD graphics hardware or that do not expose direct rendering nodes to untrusted users remain unaffected. Furthermore, standard enterprise server deployments rarely grant unprivileged users access to GPU device nodes, significantly constraining real-world exposure.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.