CVE-2026-63848

A flaw was found in the Linux kernel's AMD GPU JPEG driver. This vulnerability occurs because the JPEG rings do not support 64-bit user fence writes. An attacker could exploit this by submitting commands with 64-bit user fences, leading to the rejection of command submissions and potentially a denial of service.

This vulnerability is rated as Moderate severity because exploitation requires local access on hosts with supported AMD graphics hardware and is limited to causing a denial of service. Under typical enterprise deployments, server environments do not include discrete AMD GPUs or grant unprivileged users direct access to GPU render nodes. A local user with permissions to interact with the graphics rendering interface can craft specific command submissions that trigger driver-level submission failures, disrupting GPU video decoding services without compromising host integrity or data confidentiality.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.