Linux drm/amdgpu: UVD H.264 minimum dpb size derived from level rather than the decode message

UnscoredCVE-2026-80907NVIDIA / GPU stackcurated

Impact

The amdgpu UVD path computed the minimum decode picture buffer size for H.264 from the maximum implied by the stream level instead of the reference count actually carried in the decode message. The upstream commit is a correction to that size calculation; the record shows no demonstrated memory corruption, no CVSS score and no CWE, and the fix is a cherry-pick rather than a security-flagged change. Exposure is limited to the video decode engine, which datacenter compute workloads do not touch - it matters on nodes doing GPU transcoding with AMD parts that expose UVD, not on Instinct compute nodes running training or inference.

Who can reach it

A local user holding an open render node (/dev/dri/renderD*) who can submit a UVD decode job. No remote path and no privileged access; on a headless compute node with no video pipeline this code is not reached.

What to do

Pick up a stable kernel containing the fix (the commits are listed on the kernel.org stable links) and reboot the affected nodes on the next routine maintenance window. Given the absence of a score or a described memory-safety consequence, there is no case for an emergency drain.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-80907 https://git.kernel.org/stable/c/21a8084cd76223a13493237e04d45f5226d7cee6 https://git.kernel.org/stable/c/33f4ef585368fe93523dca1e5440e006f6e5146e https://git.kernel.org/stable/c/fa96c24485942e277483cc70d9551d9e0111d7c5

Related entries

All NVIDIA / GPU stack entries

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.