Linux kernel amdgpu: unvalidated UVD decode message fields overflow the DPB size calculation

UnscoredCVE-2026-80908NVIDIA / GPU stack+1 more CVEscurated

Impact

The UVD decode path took frame dimensions and H.265 reference counts straight from the guest-supplied decode message and fed them into the minimum DPB size arithmetic without bounds checks, so an oversized value overflows that calculation and yields a buffer smaller than the decoder will actually use. The kernel CNA split this across two ids covering the same missing-validation flaw in the same code path - CVE-2026-80908 rejects dimensions above 4096, CVE-2026-80909 rejects invalid H.265 reference counts - and the fix and the operator action are identical for both. Reach is limited: it needs a process that already holds an AMD render node and it only matters on ASICs that carry the UVD decode block, which compute-only Instinct fleets generally are not running decode workloads on. The upstream commits describe the overflow and the added rejection; they do not claim a demonstrated escalation, so treat this as driver hardening on shared AMD nodes rather than a break-glass event.

Who can reach it

Local user on the node with access to an AMD DRM render node - any tenant whose container has /dev/dri passed through for AMD GPU work. Host authentication required; no network path.

What to do

Move to a stable kernel carrying both commits and reboot the affected nodes; the validation is in the driver, so a drain-and-reboot per node is the only route and there is no runtime toggle. Nodes that are not using the UVD decode engine can be scheduled into a normal maintenance window rather than an emergency one. No AMD advisory or fixed distro version appears in the record - only the kernel stable commits.

Also covers 1 CVE

The vendor assigned a separate id to each affected code path. They share this advisory, this score and this fix, so they are one entry here.

CVE-2026-80909

References

https://nvd.nist.gov/vuln/detail/CVE-2026-80908 https://git.kernel.org/stable/c/05e1387d151f71569fbe122d2c89f9db0c21dc10 https://git.kernel.org/stable/c/17fbb996c05f2190e0fa20927ca0b9804d481b02 https://nvd.nist.gov/vuln/detail/CVE-2026-80909

Related entries

All NVIDIA / GPU stack entries

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.