CVE-2026-80909: drm/amdgpu: Reject UVD message with invalid number of h265 refs

CVE-2026-80909: drm/amdgpu: Reject UVD message with invalid number of h265 refs

[Greg Kroah-Hartman]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: Reject UVD message with invalid number of h265 refs

Same change as for h264, avoids overflow later when calculating
min dpb size.

(cherry picked from commit a4b0720e4f1601f97f59a2be9c1b4b94fa6527d5)

The Linux kernel CVE team has assigned CVE-2026-80909 to this issue.


Affected and fixed versions
===========================

	Fixed in 5.10.266 with commit 1facad2a78c1a8aeecc36eb4d560c7f1e10ce198
	Fixed in 5.15.217 with commit 499907e5d46e575e96967c0230a0a6af980a17ab
	Fixed in 6.1.184 with commit cbf1c84bf5cac2b3742ea3d2085fa713424465cc
	Fixed in 6.6.153 with commit a930c54cb67200de8bc0de87480d09ece7dcd85d
	Fixed in 6.12.105 with commit 2abcdc5f738574e7fcdd9417575dffb877fdc26f
	Fixed in 6.18.46 with commit e304c3e0d9ce251887be1f274aa0ed52219d5fd7
	Fixed in 7.1.10 with commit 0acdf1a575f59bd46717d5c487d84575af5bee8f
	Fixed in 7.2 with commit 9fca434208f1f9ab977feac62df8ebb1cc7ce893

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-80909
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/1facad2a78c1a8aeecc36eb4d560c7f1e10ce198
	https://git.kernel.org/stable/c/499907e5d46e575e96967c0230a0a6af980a17ab
	https://git.kernel.org/stable/c/cbf1c84bf5cac2b3742ea3d2085fa713424465cc
	https://git.kernel.org/stable/c/a930c54cb67200de8bc0de87480d09ece7dcd85d
	https://git.kernel.org/stable/c/2abcdc5f738574e7fcdd9417575dffb877fdc26f
	https://git.kernel.org/stable/c/e304c3e0d9ce251887be1f274aa0ed52219d5fd7
	https://git.kernel.org/stable/c/0acdf1a575f59bd46717d5c487d84575af5bee8f
	https://git.kernel.org/stable/c/9fca434208f1f9ab977feac62df8ebb1cc7ce893