Executive brief
AMD GPUs use the UVD (Unified Video Decoder) hardware block to accelerate video decoding. A flaw in the Linux kernel's amdgpu driver fails to validate the number of H.265 video references in UVD messages, allowing an integer overflow when calculating video buffer sizes. An attacker with access to submit UVD messages could trigger a kernel crash or heap corruption, disrupting GPU operations or system stability.
Technical details
The vulnerability exists in the amdgpu UVD message decoder (amdgpu_uvd_cs_msg_decode) which processes H.265 video decoding parameters. The code reads the number of decoded picture buffers (num_dpb_buffer) from user-controlled message data without range validation, then multiplies this by image_size to calculate min_dpb_size. An attacker can supply a crafted UVD message with an excessively large num_dpb_buffer value (greater than 17), causing integer overflow when calculating min_dpb_size. The fix adds a bounds check rejecting messages with num_dpb_buffer > 17. This is a local/privileged attack vector requiring the ability to submit UVD commands, typically accessible only to processes with GPU access permissions.
Affected products
- Linux Linux kernel Multiple versions prior to patching (2026-08-23)
Timeline
- 2026-09-04: disclosed: CVE-2026-80909 published
- 2026-08-23: patched: Fix committed to stable kernel trees