CVE-2026-80908

A flaw was found in the drm/amdgpu component of the Linux kernel. A local attacker could exploit this by sending a malformed Universal Video Decoder (UVD) message with dimensions exceeding 4096. This could lead to a potential overflow in the Decode Picture Buffer (DPB) size calculations, potentially resulting in memory corruption or a denial of service (DoS).

An integer overflow risk in the AMDGPU UVD command validation path can occur because UVD messages accepted decoding dimensions above 4096 and those dimensions are later used in DPB size calculations. A local user with access to the DRM render device can submit a crafted UVD decode message and potentially make the driver calculate an incorrect DPB size. The most direct impact is denial of service through GPU fault, driver reset, or kernel instability. Because the affected values are used for buffer size validation in a hardware command path, limited confidentiality or integrity impact is defensible for paranoid scoring, but full privilege escalation is not proven from this small diff alone. For the CVSS the PR:L because reliable triggering requires local code execution with access to the DRM render node or video acceleration interface. The issue is not network reachable.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.