HIGH Introduced in 4.2
amdgpu UvdMsg Overflow
CVE-2026-80908
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
01Description
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Reject UVD message with dimensions above 4096 Fixes potential overflow in DPB size calculations. (cherry picked from commit 05e1387d151f71569fbe122d2c89f9db0c21dc10)
02KernelScan AI Analysis
Risk summary
A local user with access to the AMD GPU device can submit a UVD decode message with extremely large dimensions, causing an integer overflow in DPB size calculations. This can lead to undersized buffer allocation and subsequent memory corruption, potentially causing kernel crashes or privilege escalation.
Vulnerability analysis
The video decoder message handler accepts decode messages with width and height values without an upper bound check. Extremely large dimensions cause integer overflow in downstream buffer size calculations, resulting in undersized allocations and subsequent out-of-bounds writes during video decode operations. The fix rejects any message with width or height exceeding 4096 pixels, preventing the overflow. This is reachable from a local process with access to the AMD GPU render node, requiring no special privileges beyond ordinary GPU access.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 5.15 | 4.2 | 5.15.217 | 9adc5e25f31d |
| 6.12 | 4.2 | 6.12.105 | f7af372d3b89 |
| 6.18 | 4.2 | 6.18.46 | 339deb76ee48 |
| 7.1 | 4.2 | 7.1.10 | 17fbb996c05f |
| mainline | 4.2 | 7.2 | 8c9aebcdd9f4 |
| 6.1 | 4.2 | 6.1.184 | 382bef781ff4 |
| 6.6 | 4.2 | 6.6.153 | 8435d41afcf2 |
| 5.10 | 4.2 | 5.10.266 | 8bae80eaed00 |
| cip/4.19 | 4.2 | 4.19.325-cip136 | 7a6e4763d1e7 |
| cip/4.19-rt | 4.2 | 4.19.325-cip136-rt50 | 7a6e4763d1e7 |
| cip/5.10 | 4.2 | 5.10.268-cip77 | 8bae80eaed00 |
| cip/5.10-rt | 4.2 | 5.10.268-cip77-rt34 | 8bae80eaed00 |
| cip/6.1 | 4.2 | 6.1.187-cip60 | 382bef781ff4 |
| cip/6.12 | 4.2 | 6.12.108-cip31 | f7af372d3b89 |