CVE-2026-80540

A flaw was found in the Linux kernel's drm/amdgpu component, specifically within the Universal Video Decoder (UVD) image size calculation. This vulnerability occurs because the minimum image size calculation incorrectly uses width instead of pitch and fails to reject pitch values exceeding 4096. An attacker could potentially exploit this integer overflow to cause a denial of service.

AMDGPU UVD decode validation used width instead of pitch when calculating the minimum image buffer size and also allowed pitch values above 4096. A local user with access to the DRM render node can submit a crafted UVD decode command stream where pitch is larger than width, causing the driver to accept a target buffer that may be too small for the decoder output. This creates a plausible GPU DMA out of bounds write or memory overwrite condition, with likely effects ranging from GPU reset or kernel crash to corruption of adjacent GPU mapped memory. For the CVSS the PR:L is used because DRM render node access is commonly available to non root local users or service accounts and does not require full administrator privileges. The issue is not network reachable and exploitation requires local access to the GPU device.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.