CVE-2026-80540 in Linux
Summary
by MITRE • 08/26/2026
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: Fix UVD decode image min size calculation
This needs to use pitch instead of width. Also reject pitch over 4096 to avoid overflow.
(cherry picked from commit b41c8cb12e202b220353332ab87dc01a11f69304)
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/26/2026
The Linux kernel's Direct Rendering Manager subsystem, specifically the AMDGPU driver component responsible for handling Unified Video Decoder (UVD) operations, contained a critical calculation error in determining the minimum size required for decode images. This vulnerability stems from an incorrect implementation of memory allocation logic where the code utilized the image width parameter rather than the pitch value to compute buffer sizes. In graphics processing and video decoding contexts, pitch refers to the number of bytes per row including any padding or alignment gaps, whereas width represents only the visible pixel count. By relying on width instead of pitch, the kernel underestimated the necessary memory footprint for UVD decode buffers, creating a scenario where allocated memory regions were insufficient to hold the actual data being processed by the hardware decoder.
This miscalculation leads directly to heap-based buffer overflow conditions when the GPU attempts to write decoded video frames into pre-allocated memory structures that are too small. The immediate operational impact involves potential kernel memory corruption, which can result in system instability, unexpected crashes, or denial of service for userspace applications relying on hardware-accelerated video decoding. Furthermore, because this flaw exists within a privileged driver component running with high privileges, an attacker who can trigger specific UVD decode operations might exploit the overflow to execute arbitrary code within the kernel space. This represents a significant security risk as it bypasses user-space isolation mechanisms and compromises the integrity of the entire operating system environment.
To mitigate these risks, developers implemented a fix that corrects the size calculation by strictly using pitch values for determining buffer dimensions. Additionally, the patch introduces an explicit validation check to reject any pitch value exceeding 4096 bytes per row. This upper bound serves as a safeguard against integer overflow scenarios and prevents the allocation of excessively large buffers that could be abused in denial-of-service attacks or memory exhaustion exploits. The restriction ensures that only reasonable video frame dimensions are processed, aligning with typical hardware constraints for UVD engines while preventing edge cases from triggering undefined behavior.
From a vulnerability classification perspective, this issue maps to CWE-131 Incorrect Calculation of Buffer Size and CWE-787 Out-of-bounds Write within the Common Weakness Enumeration framework. The exploitation vector typically involves local privilege escalation if an unprivileged user can invoke video decoding functions that trigger the flawed allocation path. In terms of attack patterns, this aligns with ATT&CK technique T1059 Command and Scripting Interpreter or more broadly with memory corruption exploits used for lateral movement and persistence after initial access. The cherry-picked nature of the commit indicates that this fix was backported to stable kernel branches to ensure broader protection across various distribution versions without requiring full driver updates, highlighting its importance in maintaining system security posture against known exploitation techniques targeting graphics subsystems.