CVE-2026-80907

A flaw was found in the AMD GPU driver within the Linux kernel. This vulnerability involves an incorrect calculation of the minimum size for the Unified Video Decoder (UVD) decoded picture buffer (DPB) when processing H264 video. Instead of using the actual number of references from the video's decode message, the system incorrectly uses a maximum value. This error could lead to improper memory handling, potentially causing system instability or a denial of service.

A DPB size validation issue in the AMDGPU UVD H.264 decode path can occur because the driver used a level derived maximum instead of the actual reference count provided in the decode message. A local user with access to the DRM render device may submit a crafted UVD decode message where the effective number of reference pictures does not match the size validated by the kernel. For the CVSS the PR:L is used because triggering requires local code execution with access to the GPU render or video decode interface, not full administrative privileges. The issue is not network reachable and is triggered through local GPU command submission rather than packet traffic. Impact is at least denial of service through GPU fault, reset, or decoder failure.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.