CVE-2026-80908 in Linux
Summary
by MITRE • 09/04/2026
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: Reject UVD message with dimensions above 4096
Fixes potential overflow in DPB size calculations.
(cherry picked from commit 05e1387d151f71569fbe122d2c89f9db0c21dc10)
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/04/2026
The Linux kernel's Direct Rendering Manager (DRM) subsystem, specifically the AMDGPU driver component responsible for handling UVD (Unified Video Decoder) operations, contained a critical arithmetic vulnerability related to buffer size calculations. This flaw manifests when processing video decoding commands that specify dimensions exceeding 4096 pixels in either width or height. The underlying technical issue stems from an insufficient validation of input parameters before they are used in mathematical computations for determining the Display Picture Buffer (DPB) size. When a UVD message with excessively large dimensions is received, the calculation logic fails to account for integer overflow conditions that occur during the multiplication and addition operations required to determine the total memory footprint needed for decoding frames. This lack of boundary checking allows malicious or malformed input data to trigger arithmetic errors within the kernel space, potentially leading to incorrect buffer allocations or access violations.
From a security architecture perspective, this vulnerability aligns with CWE-190 Integer Overflow or Wraparound and CWE-20 Improper Input Validation. The absence of strict upper bounds on video dimensions permits an attacker who can influence UVD message parameters to manipulate memory allocation sizes. In the context of the ATT&CK framework, this flaw could be leveraged for privilege escalation if exploited in conjunction with other kernel vulnerabilities or used as part of a Denial of Service attack by causing kernel panics through invalid memory operations. The vulnerability highlights the risks associated with hardware-specific driver code where performance optimizations sometimes bypass rigorous input sanitization steps that are standard in higher-level application logic.
The operational impact of this flaw is significant for systems relying on AMD GPUs for video processing tasks, particularly those exposed to untrusted media sources or networked streaming services. An attacker could potentially crash the system by sending a crafted UVD message with dimensions above 4096 pixels, leading to a kernel panic and subsequent service disruption. In more sophisticated attack scenarios involving memory corruption due to overflow conditions, there is a theoretical risk of arbitrary code execution if the miscalculated buffer sizes lead to out-of-bounds writes in adjacent kernel structures. This underscores the importance of robust input validation in low-level graphics drivers that interface directly with hardware resources and manage critical system memory pools.
Mitigation strategies primarily involve applying the upstream Linux kernel patch that enforces strict dimension limits on UVD messages. System administrators should ensure their AMDGPU driver versions are updated to include this fix, which explicitly rejects any message requesting dimensions greater than 4096 pixels before proceeding with DPB size calculations. Additionally, defense-in-depth measures such as enabling Kernel Self-Protection (KSP) features like KASLR and stack canaries can help mitigate the potential exploitation of memory corruption issues arising from such arithmetic flaws. Regular auditing of driver code for similar integer overflow patterns in other hardware abstraction layers is also recommended to prevent analogous vulnerabilities in related subsystems.