CVE-2026-80909 in Linux
Summary
by MITRE • 09/04/2026
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: Reject UVD message with invalid number of h265 refs
Same change as for h264, avoids overflow later when calculating min dpb size.
(cherry picked from commit a4b0720e4f1601f97f59a2be9c1b4b94fa6527d5)
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/04/2026
The Linux kernel's Direct Rendering Manager subsystem, specifically the AMDGPU driver component responsible for handling Unified Video Decoder operations, contained a logic flaw related to the processing of High Efficiency Video Coding messages. This vulnerability arises when the driver receives an H.265 video stream that specifies an invalid or excessively high number of reference frames in its header information. The core technical issue lies in the absence of strict validation checks for this specific parameter before it is utilized in subsequent computational steps within the decoder's internal state management logic.
When a malformed UVD message containing an incorrect count of H.265 references is processed, the driver proceeds to calculate the minimum size required for the Decoded Picture Buffer based on these unverified values. Because the input number of references can be arbitrarily large or structurally invalid due to maliciously crafted video data, this calculation triggers a numeric overflow condition. The resulting integer wrap-around leads to an incorrect allocation request or buffer sizing decision, which compromises the integrity of memory management operations associated with hardware decoding contexts.
The operational impact of this vulnerability is primarily centered on system stability and potential denial of service conditions for local users who can trigger the execution path involving UVD message processing. If exploited through a specially crafted video file played by an application utilizing the AMDGPU driver, the overflow could lead to kernel panics or crashes due to invalid memory access patterns derived from the corrupted buffer size calculations. While remote code execution is less likely given that this involves hardware decoder interface validation rather than direct user-space data interpretation in typical display pipelines, the stability risk remains significant for systems relying on accelerated video decoding features.
This flaw aligns with CWE-190 Integer Overflow or Wraparound and falls under the broader category of improper input validation often associated with CWE-20 Improper Input Validation. In terms of attack vectors, it relates to ATT&CK technique T1496 Resource Hijacking if used for denial-of-service purposes by consuming excessive resources during failed decoding attempts, though its primary classification remains a stability issue within the graphics subsystem rather than a direct privilege escalation path.
Mitigation strategies involve applying the upstream kernel patch that enforces strict bounds checking on the number of reference frames specified in H.265 UVD messages before they are used for buffer size calculations. System administrators should ensure their Linux distributions receive updates to the linux-image packages containing this fix, which mirrors similar protections already implemented for H.264 decoding paths. Users relying on hardware-accelerated video playback with AMD graphics hardware must maintain updated kernel versions to prevent potential crashes caused by malformed multimedia content processed through the DRM subsystem.