Executive brief
The Linux kernel's AMD GPU video decoding (UVD) unit contained an incorrect calculation for H.264 reference picture buffer sizes, using a hardcoded level-based formula instead of actual reference counts from decode messages. This could result in improper memory allocation for video decoding operations, potentially causing video decode failures or memory access issues on systems with AMD GPUs.
Technical details
This vulnerability exists in the amdgpu UVD (Unified Video Decoder) codec message decoder (amdgpu_uvd_cs_msg_decode function). The root cause is that the H.264 decoding path was computing the number of required decoded picture buffer (dpb) slots using a switch statement based on the H.264 level field (msg[57]), then applying a level-specific maximum framebuffer calculation, rather than reading the actual number of reference pictures from the decode message (msg[61]). The fix changes the calculation from level-based constants to directly extracting the reference count from bits 16-23 of msg[61] and returning -EINVAL if it exceeds 17. This affects both standard H.264 and H.264 Performance decode paths. The patch was applied to stable kernel versions and requires local kernel modification to trigger.
Affected products
- Linux Linux kernel multiple stable versions (affects drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c)
Timeline
- 2026-07-30: other: Fix authored by David Rosca