CVE-2026-63847

A flaw was found in the Linux kernel's AMD GPU JPEG driver. This issue occurs because the JPEG hardware component does not properly handle certain types of graphics commands, specifically 64-bit user fence writes. An attacker could craft and submit malicious commands, causing the system to reject these submissions. This could lead to a denial of service, making the graphics functionality unavailable.

This vulnerability is rated as Moderate severity because exploitation requires local access and only affects systems equipped with AMD graphics hardware utilizing the JPEG v2.5 engine. An unprivileged local user with access to the direct rendering manager (DRM) interface could trigger a denial of service by submitting unsupported fence operations to the graphics ring, impacting driver availability without directly compromising system confidentiality or integrity. Headless deployments or environments without affected AMD hardware are not exposed to this issue.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.