CVE-2026-80908

What it actually does

Improper input validation in the amdgpu UVD message handler permits dimensions exceeding 4096, triggering integer overflow during DPB size calculations and subsequent memory corruption in kernel video decode paths.

Why it matters to the business

Systems using AMD GPUs may experience kernel crashes, denial of service, or potential privilege escalation when processing crafted video content, increasing downtime and security risk on affected Linux deployments.

How an attack unfolds

An attacker supplies a malicious UVD message containing oversized width/height values to the amdgpu driver via userspace interfaces; the unchecked dimensions cause DPB size miscalculation, leading to out-of-bounds memory access that can be leveraged for code execution or denial of service.

How to fix it

Apply the upstream kernel patch that rejects UVD messages with dimensions above 4096; update to a kernel version containing commit 05e1387d151f71569fbe122d2c89f9db0c21dc10 or later.

How to confirm the fix worked

Confirm the fix is present by checking kernel source for the dimension-rejection logic in drm/amdgpu/uvd.c or verify the running kernel version includes the referenced commit; test by attempting to submit oversized UVD messages and confirming rejection without overflow.

Typical attack path

1. Identify a target system with the vulnerable amdgpu driver loaded
2. Craft a UVD message containing width or height values above 4096
3. Submit the message through DRM ioctl or video decode APIs
4. Trigger overflow in DPB size computation inside the kernel
5. Exploit resulting memory corruption for privilege escalation or crash

How to detect it

Review kernel logs for amdgpu UVD-related warnings or oops preceding crashes; examine audit and dmesg entries for unusual ioctl activity involving video decode buffers on AMD hardware; correlate with process execution of video applications.

What your security team should do

• Prioritize kernel updates on all AMD GPU systems within standard patch windows
• Monitor for new exploit maturity indicators and adjust EPSS-based risk scoring
• Restrict untrusted video decode workloads on multi-tenant or high-value hosts until patched