CVE-2026-80907 in Linux
Summary
by MITRE • 09/04/2026
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: Fix UVD dpb min size calculation for H264
This should use actual number of references from the decode message, instead of maximum derived from level.
(cherry picked from commit 64b525edb7e7bdfcdc77883c5e413804e2396856)
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/04/2026
The vulnerability identified in the Linux kernel's AMDGPU driver, specifically within the UVD (Unified Video Decoder) subsystem, relates to an incorrect calculation of the minimum size for the Decoded Picture Buffer used during H.264 video decoding operations. This issue stems from a logic error where the system relies on a static maximum value derived from the H.264 profile and level specifications rather than dynamically calculating the buffer requirements based on the actual number of reference frames indicated in the decode message. In high-definition video processing, particularly with formats like H.264 which utilize complex prediction structures involving multiple reference pictures, accurate memory allocation is critical for stable operation. The previous implementation assumed a worst-case scenario defined by the standard's maximum limits, but failed to account for variations where fewer references are actually employed in specific streams or sequences.
From a technical perspective, this flaw represents an improper resource management issue that can lead to either excessive memory consumption or potential buffer overflows if subsequent logic assumes the allocated size matches the actual data requirements without proper validation. While the primary intent of using maximum derived values is often safety against under-allocation, in dynamic decoding contexts, failing to align with the decode message's explicit reference count can cause synchronization issues between the hardware decoder and driver software state machines. If the calculated minimum size does not match the operational needs dictated by the stream metadata, it may result in corrupted frame rendering or instability within the graphics processing pipeline. This type of error is categorized under CWE-1342 as an Incomplete Allocation to Buffer during video decoding processes, where the allocated resource does not meet the actual requirements leading to potential undefined behavior.
The operational impact of this vulnerability primarily affects system stability and performance when handling H.264 content on AMD hardware utilizing UVD acceleration. Users may experience graphical artifacts, playback stuttering, or application crashes in media players that rely heavily on hardware-accelerated decoding for high-bitrate streams. In severe cases, particularly if the mismatch leads to out-of-bounds memory accesses due to subsequent assumptions about buffer boundaries, it could potentially be exploited for local privilege escalation or denial of service attacks against user-space applications interacting with the GPU driver. The vulnerability is classified under MITRE ATT&CK technique T1496 as Resource Hijacking through inefficient resource consumption, although its primary manifestation here is stability-related rather than malicious exploitation in most default configurations.
Mitigation strategies involve applying the upstream kernel patch that corrects the calculation logic to utilize the actual number of references provided by the decode message instead of relying on static maximum values derived from H.264 levels. System administrators and users should ensure their Linux kernels are updated to versions containing this fix, which has been cherry-picked into stable releases for broader compatibility. For developers integrating AMDGPU drivers or custom video decoding pipelines, it is essential to verify that buffer allocation routines strictly adhere to the metadata provided by the codec implementation rather than assuming worst-case static bounds without dynamic validation. Regular security audits of kernel subsystems handling multimedia processing can help identify similar discrepancies in other codecs such as HEVC or VP9 where reference frame management is equally complex and critical for secure operation.