CVE-2026-80909

What it actually does

Invalid H.265 reference count in UVD message bypasses validation and triggers buffer overflow during min DPB size calculation in the amdgpu driver.

Why it matters to the business

AMD GPU systems performing H.265 video decode may crash or become unstable, disrupting media workloads and requiring unplanned reboots or driver updates.

How an attack unfolds

An attacker constructs a UVD message containing an out-of-range number of H.265 references, submits it through the kernel interface, and triggers the same overflow path previously fixed for H.264.

How to fix it

Update the Linux kernel to include the change that rejects UVD messages with invalid H265 reference counts (cherry-pick of a4b0720e4f1601f97f59a2be9c1b4b94fa6527d5 or later equivalent).

How to confirm the fix worked

Confirm the rejection logic for invalid H265 ref counts is present in drm/amdgpu code and test with crafted UVD messages to verify overflow is prevented.

Typical attack path

1. Craft UVD message with invalid H265 ref count
2. Submit message via amdgpu UVD ioctl or firmware path
3. Driver proceeds to min DPB size calculation without bounds check
4. Overflow corrupts adjacent memory structures

How to detect it

Review kernel logs for amdgpu UVD errors mentioning reference counts or DPB calculations and correlate with unexpected process crashes during H.265 decode.

What your security team should do

• Apply the referenced kernel fix to all systems using amdgpu
• Prioritize systems that perform hardware H.265 decoding
• Reboot after kernel update to load the corrected driver