CVE-2026-80540 (GCVE-0-2026-80540)
Vulnerability from cvelistv5
Published
2026-08-26 14:37
Modified
2026-08-27 05:01
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: Fix UVD decode image min size calculation
This needs to use pitch instead of width. Also reject pitch
over 4096 to avoid overflow.
(cherry picked from commit b41c8cb12e202b220353332ab87dc01a11f69304)
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: d38ceaf99ed015f2a0b9af3499791bd3a3daae21 Version: d38ceaf99ed015f2a0b9af3499791bd3a3daae21 Version: d38ceaf99ed015f2a0b9af3499791bd3a3daae21 Version: d38ceaf99ed015f2a0b9af3499791bd3a3daae21 Version: d38ceaf99ed015f2a0b9af3499791bd3a3daae21 Version: d38ceaf99ed015f2a0b9af3499791bd3a3daae21 Version: d38ceaf99ed015f2a0b9af3499791bd3a3daae21 Version: d38ceaf99ed015f2a0b9af3499791bd3a3daae21 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "bc7397a033ac52f6d8c9bb6510d61694b2a3fce7",
"status": "affected",
"version": "d38ceaf99ed015f2a0b9af3499791bd3a3daae21",
"versionType": "git"
},
{
"lessThan": "d058f7a6709441afe1784eecd8c0643dd84750bc",
"status": "affected",
"version": "d38ceaf99ed015f2a0b9af3499791bd3a3daae21",
"versionType": "git"
},
{
"lessThan": "b7549e3f96c78921751c4b3e69af729662130d83",
"status": "affected",
"version": "d38ceaf99ed015f2a0b9af3499791bd3a3daae21",
"versionType": "git"
},
{
"lessThan": "60539d517e8439621532d8c01091ac049c596b4b",
"status": "affected",
"version": "d38ceaf99ed015f2a0b9af3499791bd3a3daae21",
"versionType": "git"
},
{
"lessThan": "271a7da84a6262a09de549912dcf6a749d169cb6",
"status": "affected",
"version": "d38ceaf99ed015f2a0b9af3499791bd3a3daae21",
"versionType": "git"
},
{
"lessThan": "25ee120f3803ad9e416ef9f76f4c3234cc4d645b",
"status": "affected",
"version": "d38ceaf99ed015f2a0b9af3499791bd3a3daae21",
"versionType": "git"
},
{
"lessThan": "5cbd8af02b0b9c8723fa30edcf6fccab5170af8d",
"status": "affected",
"version": "d38ceaf99ed015f2a0b9af3499791bd3a3daae21",
"versionType": "git"
},
{
"lessThan": "b8bb9ba3f101a1b0011f785a577a4a0a38371174",
"status": "affected",
"version": "d38ceaf99ed015f2a0b9af3499791bd3a3daae21",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.2"
},
{
"lessThan": "4.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.266",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.217",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.184",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.153",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.105",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.46",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.266",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.217",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.184",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.153",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.105",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.46",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.10",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: Fix UVD decode image min size calculation\n\nThis needs to use pitch instead of width. Also reject pitch\nover 4096 to avoid overflow.\n\n(cherry picked from commit b41c8cb12e202b220353332ab87dc01a11f69304)"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - Reachable only via AMDGPU_CS ioctl on a local DRM render node (/dev/dri/renderD*), through amdgpu_cs_ioctl \u2192 amdgpu_cs_patch_ibs \u2192 amdgpu_uvd_ring_parse_cs \u2192 amdgpu_uvd_cs_pass2 \u2192 amdgpu_uvd_cs_msg \u2192 amdgpu_uvd_cs_msg_decode; not reachable from any network-facing kernel service.\nAC:L - An attacker with render-node access fully controls UVD decode message fields (width, height, pitch in msg[28], stream_type) in their own BO and can reliably set pitch \u003e width (only width \u003e pitch was rejected) to force an underestimated buf_sizes[0x2] check.\nPR:L - Exploitation requires only standard unprivileged local access to the AMDGPU DRM render node (DRM_AUTH|DRM_RENDER_ALLOW on AMDGPU_CS ioctl), not real root; user namespaces alone do not grant render-node access.\nUI:N - No victim interaction is required; a local attacker can directly craft and submit a UVD command stream with a decode message via AMDGPU_CS ioctl after creating a valid UVD session handle.\nS:U - Impact is confined to the kernel/GPU driver on the local host (GPU out-of-bounds access within the attacker\u0027s DRM client address space); it does not cross VM, IOMMU, or sandbox boundaries to a different security authority.\nC:H - Underestimating the decode image minimum size lets undersized buffers pass amdgpu_uvd_cs_pass2 validation while the UVD engine decodes using pitch stride, enabling out-of-bounds reads of adjacent GPU-mapped memory that may contain sensitive data.\nI:H - Using image_size (width-based) instead of (pitch*height)*3/2 for buf_sizes[0x2] allows the UVD hardware to perform large out-of-bounds writes past the validated buffer when pitch exceeds width, corrupting adjacent GPU-mapped memory.\nA:H - Large GPU out-of-bounds writes from the UVD decode engine can hang or reset the GPU driver and may trigger kernel oops/panic; unbounded pitch before the fix also risked integer overflow wrapping the minimum size to near-zero, amplifying corruption."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T05:01:29.500Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/bc7397a033ac52f6d8c9bb6510d61694b2a3fce7"
},
{
"url": "https://git.kernel.org/stable/c/d058f7a6709441afe1784eecd8c0643dd84750bc"
},
{
"url": "https://git.kernel.org/stable/c/b7549e3f96c78921751c4b3e69af729662130d83"
},
{
"url": "https://git.kernel.org/stable/c/60539d517e8439621532d8c01091ac049c596b4b"
},
{
"url": "https://git.kernel.org/stable/c/271a7da84a6262a09de549912dcf6a749d169cb6"
},
{
"url": "https://git.kernel.org/stable/c/25ee120f3803ad9e416ef9f76f4c3234cc4d645b"
},
{
"url": "https://git.kernel.org/stable/c/5cbd8af02b0b9c8723fa30edcf6fccab5170af8d"
},
{
"url": "https://git.kernel.org/stable/c/b8bb9ba3f101a1b0011f785a577a4a0a38371174"
}
],
"title": "drm/amdgpu: Fix UVD decode image min size calculation",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80540",
"datePublished": "2026-08-26T14:37:13.966Z",
"dateReserved": "2026-08-26T14:34:25.765Z",
"dateUpdated": "2026-08-27T05:01:29.500Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…