CVE-2026-80909
Received Received - Intake

AMDGPU UVD H.265 Reference Overflow Fix

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Reject UVD message with invalid number of h265 refs Same change as for h264, avoids overflow later when calculating min dpb size. (cherry picked from commit a4b0720e4f1601f97f59a2be9c1b4b94fa6527d5)

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-05
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-80909
EUVD
EUVD-2026-71668

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a flaw in the AMDGPU driver where an invalid number of H.265 references in a UVD message is not properly rejected. This can lead to an overflow when calculating the minimum DPB (Decoded Picture Buffer) size later in the process.

Impact Analysis

This vulnerability could potentially allow an attacker to cause a system crash or trigger unexpected behavior in the kernel by sending malformed UVD messages. It may lead to denial-of-service conditions or other unintended consequences on affected systems.

Mitigation Strategies

Update the Linux kernel to a patched version that includes the fix for the AMDGPU UVD message handling vulnerability. Monitor vendor advisories for kernel updates.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-80909. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart