---
id: CVE-2026-63846
title: 'drm/amdgpu/jpeg: set no_user_fence for JPEG v3.0 ring'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  drm/amdgpu/jpeg: set no_user_fence for JPEG v3.0 ring

  JPEG rings do not support 64-bit user fence writes, reject CS
  submissions with user fences.

  (cherry picked from …
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= dfd57dbf44ddc70c90c76f83b2deb46e5dd40ce3 <
    ee035a9d3eed3a9f5a3e83c31a10b321c9598861
  - >-
    Linux >= dfd57dbf44ddc70c90c76f83b2deb46e5dd40ce3 <
    303da8279f195cc741adc52c1b44d6b64de63bb0
  - >-
    Linux >= dfd57dbf44ddc70c90c76f83b2deb46e5dd40ce3 <
    5ada37d7f736f9feeaa06a25e470a4c74e67a61a
  - >-
    Linux >= dfd57dbf44ddc70c90c76f83b2deb46e5dd40ce3 <
    48ce00787e3fddd2b45692fc991b8ab128343da5
  - >-
    Linux >= dfd57dbf44ddc70c90c76f83b2deb46e5dd40ce3 <
    a2baf12eec41f246689e6a3f8619af1200031576
  - Linux 5.9
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T15:31:56.865035Z'
published: '2026-07-19'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:42:06.847Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-63846'
references:
  - url: 'https://git.kernel.org/stable/c/ee035a9d3eed3a9f5a3e83c31a10b321c9598861'
  - url: 'https://git.kernel.org/stable/c/303da8279f195cc741adc52c1b44d6b64de63bb0'
  - url: 'https://git.kernel.org/stable/c/5ada37d7f736f9feeaa06a25e470a4c74e67a61a'
  - url: 'https://git.kernel.org/stable/c/48ce00787e3fddd2b45692fc991b8ab128343da5'
  - url: 'https://git.kernel.org/stable/c/a2baf12eec41f246689e6a3f8619af1200031576'
tags:
  - cve.org
epss: 0.00175
epssPercentile: 0.06542
ingestedAt: '2026-10-16T17:24:46.758Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu/jpeg: set no_user_fence for JPEG v3.0 ring

JPEG rings do not support 64-bit user fence writes, reject CS
submissions with user fences.

(cherry picked from commit 4d7d774f100efb5089c86a1fb8c5bf47c63fc9ef)

## Affected

- `Linux >= dfd57dbf44ddc70c90c76f83b2deb46e5dd40ce3 < ee035a9d3eed3a9f5a3e83c31a10b321c9598861`
- `Linux >= dfd57dbf44ddc70c90c76f83b2deb46e5dd40ce3 < 303da8279f195cc741adc52c1b44d6b64de63bb0`
- `Linux >= dfd57dbf44ddc70c90c76f83b2deb46e5dd40ce3 < 5ada37d7f736f9feeaa06a25e470a4c74e67a61a`
- `Linux >= dfd57dbf44ddc70c90c76f83b2deb46e5dd40ce3 < 48ce00787e3fddd2b45692fc991b8ab128343da5`
- `Linux >= dfd57dbf44ddc70c90c76f83b2deb46e5dd40ce3 < a2baf12eec41f246689e6a3f8619af1200031576`
- `Linux 5.9`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.