On July 19, 2026, the National Vulnerability Database published CVE-2026-53375, a flaw in the Linux kernel’s AMDGPU driver that could corrupt memory addresses sent to video-encoding firmware. The bug, which affects systems using AMD’s Video Coding Engine (VCE) on Linux, can cause encoding failures, GPU hangs, or system instability. Patches have already landed in multiple stable kernel branches, and native Windows installations are not directly affected.
The Flaw: A Partial Address Patch Gone Wrong
The vulnerability lives in drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c, the part of the kernel that manages AMD’s hardware video encoder. When the kernel prepares a command for the VCE firmware, it sometimes needs to patch a GPU memory address that is split into low and high portions. The original code had a critical logic gap: if only one of these two parts was valid—for instance, the low portion was correct but the high portion was invalid—the driver would still apply that single patch. The result? The firmware received a malformed address pointing to an unintended or invalid memory location.
According to the kernel.org advisory, this “could result in a bad address written to in FW.” The consequences range from glitchy video encodes to full-on GPU resets and system hangs. The bug does not, by itself, enable arbitrary code execution or privilege escalation, and no public exploit has been reported. But any flaw in a kernel graphics path that handles privileged hardware commands is serious enough to warrant a careful update.
What’s Affected, and What Isn’t
Linux Systems with AMD GPUs
This is a Linux kernel bug. It’s present in all kernels from version 4.2 onward that include the vulnerable AMDGPU VCE code. If you run a recent Linux distribution on a machine with an AMD graphics card and use hardware-accelerated video encoding (or even just have the driver loaded), you are likely affected until you patch.
The affected component is the amdgpu kernel module, which is the standard open-source driver for AMD Radeon graphics on Linux. The VCE block is most active in media-transcoding workloads—think OBS streaming, video-editing renders, or server-side video processing with ffmpeg and VA-API. Home users who never touch video encoding might still be at risk if a background process or application triggers the vulnerable path, but the probability is lower.
Windows Users: Relax, But Don’t Ignore Completely
For a pure Windows PC—one that boots Windows 11 or 10 directly and never runs Linux—CVE-2026-53375 is a non-issue. The flaw is in the Linux kernel’s AMDGPU driver, not in AMD Software: Adrenalin Edition, the Windows display driver, or the DirectX stack. Microsoft’s own advisory confirms the CVE is for a Linux kernel component and does not list any Windows products as affected.
However, many “Windows users” also have Linux somewhere nearby. Dual-boot workstations, Linux build servers in a Windows-centric domain, GPU-accelerated virtual machines, or even a WSL 2 instance that uses a custom kernel could expose the bug. WSL 2’s default kernel is Microsoft-managed and does not load the host’s amdgpu driver directly, but if you’ve replaced it with a stock distribution kernel, you need to verify. Similarly, appliances and media-processing boxes that run a Linux-based OS but are administered from Windows consoles need to be checked.
How We Got Here
The bug was introduced with the initial git commit of the amdgpu driver—kernel version 4.2—and persisted for years because the partial-patching scenario rarely manifested in testing. The fix, first merged into the 6.1 long-term branch and then backported to others, is remarkably simple: the driver now refuses to patch an address unless both lo and hi components are valid simultaneously. The kernel.org advisory lists six distinct commit hashes, each corresponding to a stable-tree backport.
No CVSS score has been assigned yet by NVD or the primary source, kernel.org. That’s normal for newly published CVEs; scoring often follows within days. The lack of a severity rating should not delay patching on production systems, especially those that handle sensitive or high-availability video workloads.
What to Do Now: A Practical Checklist
For Linux administrators and power users:
- Identify every system with an AMD GPU that runs a Linux kernel below the fixed version for its branch.
- Check your distribution’s security advisories rather than relying solely on
uname -r. Ubuntu, RHEL, Fedora, Debian, and SUSE all backport fixes; your kernel package version may differ from the upstream stable tag. - The following upstream stable kernel releases contain the fix:
| Kernel series | Fixed version |
|---|---|
| 6.1 LTS | 6.1.175 |
| 6.6 LTS | 6.6.140 |
| 6.12 LTS | 6.12.90 |
| 6.18 stable | 6.18.32 |
| 7.0 stable | 7.0.9 |
| 7.1 and later | 7.1 (fix included from start) |
- Update to your distribution’s latest kernel package, then reboot. A kernel update won’t take effect until you boot into the new image.
- Prioritize systems that actively use GPU video encoding—media servers, transcoding nodes, streaming workstations, or container hosts that expose AMD GPU resources to users.
- Do not disable the AMDGPU driver wholesale as a knee-jerk reaction; that strips away display and compute functionality and may not even close the window if the vulnerable path isn’t triggered.
For IT managers overseeing mixed Windows/Linux fleets:
- Scan your asset inventory for Linux hosts with AMD graphics hardware. This includes developer desktops that dual-boot, GPU-equipped servers, and appliances running Linux-based firmware.
- Communicate clearly: this is a Linux kernel issue, not a Windows patch Tuesday item. End-users on Windows do not need to update AMD drivers or Windows itself in response to this CVE.
- Test the kernel update on a representative system before broad deployment, but don’t delay on externally facing media-processing services.
For Windows-only home users and enthusiasts:
- If your machine has never booted Linux and you don’t use WSL 2 with a custom kernel, you can ignore this CVE. Your AMD graphics driver on Windows is unaffected.
- If you dual-boot or run a Linux VM with GPU passthrough, apply the kernel update on the Linux side at your next maintenance window.
The Outlook
The NVD entry is expected to receive CVSS scoring soon, which will help organizations apply consistent severity policies. Meanwhile, major Linux distributions are already issuing their own advisories. For example, Ubuntu’s USN and Red Hat’s customer portal will soon reflect the backported fix if they haven’t already. Keep an eye on your distribution’s security tracker, and treat this as a routine but important kernel maintenance item.
CVE-2026-53375 is a perfect example of why Linux users must stay current with kernel updates: a single logic flaw in a driver can turn a reliable video encoder into a source of crashes. The fix is here, it’s minimal, and it closes a real—if narrow—window of instability. Update, reboot, and get back to work.