From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-cve-announce@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@kernel.org>
Subject: CVE-2026-80909: drm/amdgpu: Reject UVD message with invalid number of h265 refs
Date: Fri, 4 Sep 2026 19:17:40 +0200 [thread overview]
Message-ID: <2026090434-CVE-2026-80909-3ac3@gregkh> (raw)
From: Greg Kroah-Hartman <gregkh@kernel.org>
Description
===========
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: Reject UVD message with invalid number of h265 refs
Same change as for h264, avoids overflow later when calculating
min dpb size.
(cherry picked from commit a4b0720e4f1601f97f59a2be9c1b4b94fa6527d5)
The Linux kernel CVE team has assigned CVE-2026-80909 to this issue.
Affected and fixed versions
===========================
Fixed in 5.10.266 with commit 1facad2a78c1a8aeecc36eb4d560c7f1e10ce198
Fixed in 5.15.217 with commit 499907e5d46e575e96967c0230a0a6af980a17ab
Fixed in 6.1.184 with commit cbf1c84bf5cac2b3742ea3d2085fa713424465cc
Fixed in 6.6.153 with commit a930c54cb67200de8bc0de87480d09ece7dcd85d
Fixed in 6.12.105 with commit 2abcdc5f738574e7fcdd9417575dffb877fdc26f
Fixed in 6.18.46 with commit e304c3e0d9ce251887be1f274aa0ed52219d5fd7
Fixed in 7.1.10 with commit 0acdf1a575f59bd46717d5c487d84575af5bee8f
Fixed in 7.2 with commit 9fca434208f1f9ab977feac62df8ebb1cc7ce893
Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.
Unaffected versions might change over time as fixes are backported to
older supported kernel versions. The official CVE entry at
https://cve.org/CVERecord/?id=CVE-2026-80909
will be updated if fixes are backported, please check that for the most
up to date information about this issue.
Affected files
==============
The file(s) affected by this issue are:
drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c
Mitigation
==========
The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes. Individual
changes are never tested alone, but rather are part of a larger kernel
release. Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all. If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
https://git.kernel.org/stable/c/1facad2a78c1a8aeecc36eb4d560c7f1e10ce198
https://git.kernel.org/stable/c/499907e5d46e575e96967c0230a0a6af980a17ab
https://git.kernel.org/stable/c/cbf1c84bf5cac2b3742ea3d2085fa713424465cc
https://git.kernel.org/stable/c/a930c54cb67200de8bc0de87480d09ece7dcd85d
https://git.kernel.org/stable/c/2abcdc5f738574e7fcdd9417575dffb877fdc26f
https://git.kernel.org/stable/c/e304c3e0d9ce251887be1f274aa0ed52219d5fd7
https://git.kernel.org/stable/c/0acdf1a575f59bd46717d5c487d84575af5bee8f
https://git.kernel.org/stable/c/9fca434208f1f9ab977feac62df8ebb1cc7ce893
reply other threads:[~2026-09-04 17:21 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=2026090434-CVE-2026-80909-3ac3@gregkh \
--to=gregkh@linuxfoundation.org \
--cc=cve@kernel.org \
--cc=gregkh@kernel.org \
--cc=linux-cve-announce@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.