Executive brief
AMD GPU video decoding (UVD) components in the Linux kernel are susceptible to an integer overflow in DPB size calculations when processing video messages with excessively large dimensions. An attacker with the ability to submit malformed UVD messages could trigger memory corruption or denial of service, affecting systems that rely on GPU video decoding functionality.
Technical details
This vulnerability is an integer overflow in the AMD GPU UVD (Unified Video Decoder) message decoder in the kernel driver (drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c). The vulnerable code performs calculations on DPB (Decoded Picture Buffer) size based on width and height dimensions without validating an upper bound; only a lower bound of 16 pixels was enforced. An attacker can craft a UVD message with dimensions greater than 4096 pixels, causing arithmetic overflow in DPB size calculations and resulting in heap corruption or denial of service. The fix adds an upper bound check rejecting messages with width or height exceeding 4096. Attack vector requires local access to submit UVD messages via the GPU driver interface.
Affected products
- Linux Linux kernel all versions prior to patched stable branches
Timeline
- 2026-09-04: disclosed
- 2026-08-23: patched