CVE-2026-80909: drm/amdgpu: Reject UVD message with invalid number of h265 refs
Published Sep 4, 2026
·Updated
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: Reject UVD message with invalid number of h265 refs
Same change as for h264, avoids overflow later when calculating min dpb size.
(cherry picked from commit a4b0720e4f1601f97f59a2be9c1b4b94fa6527d5)
Event History
Sep 4, 2026
CVE Published
via MITRE·05:19 PM
Data Sourced
via MITRE·05:19 PM
Description
Frequently Asked Questions
1
What input triggers the flaw?
The issue is triggered by a UVD message that specifies an invalid number of H.265 references. That value can later cause an overflow while the minimum decoded picture buffer size is calculated.
2
What does the fix do?
The fix rejects UVD messages with an invalid H.265 reference count before the later decoded picture buffer size calculation occurs.