Linux kernel amdgpu UVD: decode image size computed from width instead of pitch
Impact
The UVD message validation path computed the minimum decode image size from the image width rather than the pitch, and did not bound the pitch at all. The fix uses pitch and rejects pitch values over 4096 to avoid overflow, so an unprivileged submitter could get the driver to accept a decode buffer smaller than the engine will actually write. The record is a terse cherry-pick with no CVSS, no CWE and no exploitation detail, so treat the concrete consequence as unestablished beyond an undersized-buffer validation failure driven by userspace-supplied dimensions. Reachability is narrow on datacenter parts: this is the legacy UVD engine, not VCN, so accelerator SKUs without UVD are not affected.
Who can reach it
Local user with access to an amdgpu render node submitting UVD decode work with attacker-chosen image dimensions. No special privilege beyond device access. Only nodes with GPUs that expose the UVD engine are in scope.
What to do
Apply the stable fix, which switches the calculation to pitch and rejects pitch over 4096; five stable commits are listed and no fixed release version appears in the record. Rollout is a patched kernel and a per-node reboot, so drain the node first. If your GPUs have no UVD block, this can wait for the normal kernel cadence.
References
Related entries
- Linux kernel amdgpu: unvalidated GEM_CREATE domain combinations hit a BUG_ON and panic the nodeCVE-2026-80541 · Linux kernel amdgpu (amdgpu_gem_create_ioctl, GEM_CREATE domain combination validation)Unscored
- Linux kernel amdgpu display: NULL dereference when vblank is requested on a CRTC with no streamCVE-2026-80542 · Linux kernel amdgpu display core (amdgpu_dm_crtc_set_vblank, CRTC with no stream attached)Unscored
- Linux kernel amdgpu: user-supplied indirect buffer size is unbounded, corrupting ring packet fieldsCVE-2026-80576 · Linux kernel drm/amdgpu (command submission, amdgpu_cs_p2_ib IB size)Unscored
- GPU / accelerator firmware (VBIOS, GSP, NVSwitch): GPU-resident firmware sits below the host OS and is not coveredNCVD-0000-012-gpu-accelerator-firmware-vbios-g · GPU / accelerator firmware (VBIOS, GSP, NVSwitch)Unscored
- NVIDIA Multi-Instance GPU (MIG) partitioning: MIG gives each instance its own SM slice, L2 slice, memory slice andNCVD-2020-001-nvidia-multi-instance-gpu-mig-pa · NVIDIA Multi-Instance GPU (MIG) partitioningUnscored
- NVIDIA Multi-Instance GPU (MIG) partitioning: MIG gives each instance its own SM slice, L2 slice, memory slice andNCVD-2020-003-nvidia-multi-instance-gpu-mig-pa · NVIDIA Multi-Instance GPU (MIG) partitioningUnscored
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.