{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-80540", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-26T14:34:25.765Z", "datePublished": "2026-08-26T14:37:13.966Z", "dateUpdated": "2026-08-27T05:01:29.500Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-27T05:01:29.500Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: Fix UVD decode image min size calculation\n\nThis needs to use pitch instead of width. Also reject pitch\nover 4096 to avoid overflow.\n\n(cherry picked from commit b41c8cb12e202b220353332ab87dc01a11f69304)"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - Reachable only via AMDGPU_CS ioctl on a local DRM render node (/dev/dri/renderD*), through amdgpu_cs_ioctl \u2192 amdgpu_cs_patch_ibs \u2192 amdgpu_uvd_ring_parse_cs \u2192 amdgpu_uvd_cs_pass2 \u2192 amdgpu_uvd_cs_msg \u2192 amdgpu_uvd_cs_msg_decode; not reachable from any network-facing kernel service.\nAC:L - An attacker with render-node access fully controls UVD decode message fields (width, height, pitch in msg[28], stream_type) in their own BO and can reliably set pitch > width (only width > pitch was rejected) to force an underestimated buf_sizes[0x2] check.\nPR:L - Exploitation requires only standard unprivileged local access to the AMDGPU DRM render node (DRM_AUTH|DRM_RENDER_ALLOW on AMDGPU_CS ioctl), not real root; user namespaces alone do not grant render-node access.\nUI:N - No victim interaction is required; a local attacker can directly craft and submit a UVD command stream with a decode message via AMDGPU_CS ioctl after creating a valid UVD session handle.\nS:U - Impact is confined to the kernel/GPU driver on the local host (GPU out-of-bounds access within the attacker's DRM client address space); it does not cross VM, IOMMU, or sandbox boundaries to a different security authority.\nC:H - Underestimating the decode image minimum size lets undersized buffers pass amdgpu_uvd_cs_pass2 validation while the UVD engine decodes using pitch stride, enabling out-of-bounds reads of adjacent GPU-mapped memory that may contain sensitive data.\nI:H - Using image_size (width-based) instead of (pitch*height)*3/2 for buf_sizes[0x2] allows the UVD hardware to perform large out-of-bounds writes past the validated buffer when pitch exceeds width, corrupting adjacent GPU-mapped memory.\nA:H - Large GPU out-of-bounds writes from the UVD decode engine can hang or reset the GPU driver and may trigger kernel oops/panic; unbounded pitch before the fix also risked integer overflow wrapping the minimum size to near-zero, amplifying corruption."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c"], "versions": [{"version": "d38ceaf99ed015f2a0b9af3499791bd3a3daae21", "lessThan": "bc7397a033ac52f6d8c9bb6510d61694b2a3fce7", "status": "affected", "versionType": "git"}, {"version": "d38ceaf99ed015f2a0b9af3499791bd3a3daae21", "lessThan": "d058f7a6709441afe1784eecd8c0643dd84750bc", "status": "affected", "versionType": "git"}, {"version": "d38ceaf99ed015f2a0b9af3499791bd3a3daae21", "lessThan": "b7549e3f96c78921751c4b3e69af729662130d83", "status": "affected", "versionType": "git"}, {"version": "d38ceaf99ed015f2a0b9af3499791bd3a3daae21", "lessThan": "60539d517e8439621532d8c01091ac049c596b4b", "status": "affected", "versionType": "git"}, {"version": "d38ceaf99ed015f2a0b9af3499791bd3a3daae21", "lessThan": "271a7da84a6262a09de549912dcf6a749d169cb6", "status": "affected", "versionType": "git"}, {"version": "d38ceaf99ed015f2a0b9af3499791bd3a3daae21", "lessThan": "25ee120f3803ad9e416ef9f76f4c3234cc4d645b", "status": "affected", "versionType": "git"}, {"version": "d38ceaf99ed015f2a0b9af3499791bd3a3daae21", "lessThan": "5cbd8af02b0b9c8723fa30edcf6fccab5170af8d", "status": "affected", "versionType": "git"}, {"version": "d38ceaf99ed015f2a0b9af3499791bd3a3daae21", "lessThan": "b8bb9ba3f101a1b0011f785a577a4a0a38371174", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c"], "versions": [{"version": "4.2", "status": "affected"}, {"version": "0", "lessThan": "4.2", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.266", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.217", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.184", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.153", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.105", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.46", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.10", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.2", "versionEndExcluding": "5.10.266"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.2", "versionEndExcluding": "5.15.217"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.2", "versionEndExcluding": "6.1.184"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.2", "versionEndExcluding": "6.6.153"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.2", "versionEndExcluding": "6.12.105"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.2", "versionEndExcluding": "6.18.46"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.2", "versionEndExcluding": "7.1.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.2", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/bc7397a033ac52f6d8c9bb6510d61694b2a3fce7"}, {"url": "https://git.kernel.org/stable/c/d058f7a6709441afe1784eecd8c0643dd84750bc"}, {"url": "https://git.kernel.org/stable/c/b7549e3f96c78921751c4b3e69af729662130d83"}, {"url": "https://git.kernel.org/stable/c/60539d517e8439621532d8c01091ac049c596b4b"}, {"url": "https://git.kernel.org/stable/c/271a7da84a6262a09de549912dcf6a749d169cb6"}, {"url": "https://git.kernel.org/stable/c/25ee120f3803ad9e416ef9f76f4c3234cc4d645b"}, {"url": "https://git.kernel.org/stable/c/5cbd8af02b0b9c8723fa30edcf6fccab5170af8d"}, {"url": "https://git.kernel.org/stable/c/b8bb9ba3f101a1b0011f785a577a4a0a38371174"}], "title": "drm/amdgpu: Fix UVD decode image min size calculation", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "bc7397a033ac52f6d8c9bb6510d61694b2a3fce7", "status": "affected", "version": "d38ceaf99ed015f2a0b9af3499791bd3a3daae21", "versionType": "git"}, {"lessThan": "d058f7a6709441afe1784eecd8c0643dd84750bc", "status": "affected", "version": "d38ceaf99ed015f2a0b9af3499791bd3a3daae21", "versionType": "git"}, {"lessThan": "b7549e3f96c78921751c4b3e69af729662130d83", "status": "affected", "version": "d38ceaf99ed015f2a0b9af3499791bd3a3daae21", "versionType": "git"}, {"lessThan": "60539d517e8439621532d8c01091ac049c596b4b", "status": "affected", "version": "d38ceaf99ed015f2a0b9af3499791bd3a3daae21", "versionType": "git"}, {"lessThan": "271a7da84a6262a09de549912dcf6a749d169cb6", "status": "affected", "version": "d38ceaf99ed015f2a0b9af3499791bd3a3daae21", "versionType": "git"}, {"lessThan": "25ee120f3803ad9e416ef9f76f4c3234cc4d645b", "status": "affected", "version": "d38ceaf99ed015f2a0b9af3499791bd3a3daae21", "versionType": "git"}, {"lessThan": "5cbd8af02b0b9c8723fa30edcf6fccab5170af8d", "status": "affected", "version": "d38ceaf99ed015f2a0b9af3499791bd3a3daae21", "versionType": "git"}, {"lessThan": "b8bb9ba3f101a1b0011f785a577a4a0a38371174", "status": "affected", "version": "d38ceaf99ed015f2a0b9af3499791bd3a3daae21", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.2"}, {"lessThan": "4.2", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.266", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.217", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.184", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.153", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.105", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.46", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.10", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: Fix UVD decode image min size calculation\n\nThis needs to use pitch instead of width. Also reject pitch\nover 4096 to avoid overflow.\n\n(cherry picked from commit b41c8cb12e202b220353332ab87dc01a11f69304)"}], "id": "CVE-2026-80540", "lastModified": "2026-08-27T06:17:34.813", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-08-26T15:17:08.257", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/25ee120f3803ad9e416ef9f76f4c3234cc4d645b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/271a7da84a6262a09de549912dcf6a749d169cb6"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/5cbd8af02b0b9c8723fa30edcf6fccab5170af8d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/60539d517e8439621532d8c01091ac049c596b4b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b7549e3f96c78921751c4b3e69af729662130d83"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b8bb9ba3f101a1b0011f785a577a4a0a38371174"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/bc7397a033ac52f6d8c9bb6510d61694b2a3fce7"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/d058f7a6709441afe1784eecd8c0643dd84750bc"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: drm/amdgpu: Fix UVD decode image min size calculation", "id": "2524487", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2524487"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-190", "details": ["In the Linux kernel, the following vulnerability has been resolved:\ndrm/amdgpu: Fix UVD decode image min size calculation\nThis needs to use pitch instead of width. Also reject pitch\nover 4096 to avoid overflow.\n(cherry picked from commit b41c8cb12e202b220353332ab87dc01a11f69304)", "A flaw was found in the Linux kernel's `drm/amdgpu` component, specifically within the Universal Video Decoder (UVD) image size calculation. This vulnerability occurs because the minimum image size calculation incorrectly uses `width` instead of `pitch` and fails to reject `pitch` values exceeding 4096. An attacker could potentially exploit this integer overflow to cause a denial of service."], "name": "CVE-2026-80540", "public_date": "2026-08-26T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-80540\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-80540\nhttps://lore.kernel.org/linux-cve-announce/2026082605-CVE-2026-80540-2460@gregkh/T"], "threat_severity": "Moderate"}