GPU VulnDB

Database/NVIDIA / GPU stack

Linux kernel amdgpu UVD: decode image size computed from width instead of pitch

UnscoredCVE-2026-80540NVIDIA / GPU stackcurated

Impact

The UVD message validation path computed the minimum decode image size from the image width rather than the pitch, and did not bound the pitch at all. The fix uses pitch and rejects pitch values over 4096 to avoid overflow, so an unprivileged submitter could get the driver to accept a decode buffer smaller than the engine will actually write. The record is a terse cherry-pick with no CVSS, no CWE and no exploitation detail, so treat the concrete consequence as unestablished beyond an undersized-buffer validation failure driven by userspace-supplied dimensions. Reachability is narrow on datacenter parts: this is the legacy UVD engine, not VCN, so accelerator SKUs without UVD are not affected.

Who can reach it

Local user with access to an amdgpu render node submitting UVD decode work with attacker-chosen image dimensions. No special privilege beyond device access. Only nodes with GPUs that expose the UVD engine are in scope.

What to do

Apply the stable fix, which switches the calculation to pitch and rejects pitch over 4096; five stable commits are listed and no fixed release version appears in the record. Rollout is a patched kernel and a per-node reboot, so drain the node first. If your GPUs have no UVD block, this can wait for the normal kernel cadence.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-80540https://git.kernel.org/stable/c/25ee120f3803ad9e416ef9f76f4c3234cc4d645bhttps://git.kernel.org/stable/c/271a7da84a6262a09de549912dcf6a749d169cb6https://git.kernel.org/stable/c/5cbd8af02b0b9c8723fa30edcf6fccab5170af8d

Related entries

All NVIDIA / GPU stack entries

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.