Executive brief
The Linux kernel's AMD GPU driver contains a flaw in how it calculates video decode buffer sizes. An attacker with local access to the GPU device can craft malicious input parameters that cause integer overflow or out-of-bounds memory access, potentially leading to kernel crashes or local privilege escalation on systems with AMD graphics.
Technical details
The vulnerability exists in the amdgpu_uvd_cs_msg_decode() function in drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c. The code incorrectly calculated image buffer size using width instead of pitch, and failed to validate the pitch parameter against a maximum threshold. A malicious user-mode application sending crafted UVD decode commands can supply an oversized pitch value that causes integer overflow when computing buf_sizes[0x2], leading to undersized memory allocation. This enables heap overflow or out-of-bounds access. The fix replaces the buggy calculation with proper pitch-based arithmetic (pitch * height * 3 / 2) and adds validation to reject pitch values over 4096. Local access to the GPU device (typically /dev/dri/card* or /dev/dri/renderD*) is required. A patch is available in mainline and stable kernel branches.
Affected products
- Linux Linux kernel All versions prior to patch (mainline commit b41c8cb12e202b220353332ab87dc01a11f69304)
Timeline
- 2026-08-26: disclosed: CVE-2026-80540 published on NVD
- 2026-07-30: patched: Fix committed upstream (commit b41c8cb12e202b220353332ab87dc01a11f69304)
- 2026-08-23: patched: Cherry-picked into stable kernel branches (commit 25ee120f and 271a7da84)