CVE-2026-80540 Overview
CVE-2026-80540 is a kernel vulnerability in the AMD GPU (amdgpu) driver's Unified Video Decoder (UVD) subsystem. The flaw resides in the UVD decode image minimum size calculation, which incorrectly used width instead of pitch and failed to bound the pitch value. Unbounded pitch values can trigger an integer overflow during size computation. Local, low-privileged users interacting with the DRM interface can leverage this condition to compromise kernel memory integrity and stability. Upstream maintainers resolved the issue by switching to pitch and rejecting values over 4096 to prevent overflow.
Critical Impact
Local integer overflow in the amdgpu UVD decode path may lead to kernel memory corruption, impacting confidentiality, integrity, and availability on affected Linux systems.
Affected Products
- Linux kernel drm/amdgpu driver (UVD decode path)
- Multiple stable Linux kernel branches receiving the backported fix
- Systems using AMD GPUs with UVD hardware decode acceleration
Discovery Timeline
- 2026-08-26 - CVE-2026-80540 published to NVD
- 2026-08-27 - Last updated in NVD database
Technical Details for CVE-2026-80540
Vulnerability Analysis
The vulnerability affects the UVD decode buffer validation logic in the AMD GPU DRM (Direct Rendering Manager) driver. When calculating the minimum size required for a decode image buffer, the driver used the frame width rather than the memory pitch. Pitch represents the actual stride (bytes per row) in memory and can differ from width due to hardware alignment requirements. Using width allowed callers to submit buffers where the true required size exceeded the calculated minimum, resulting in undersized allocations relative to hardware DMA operations.
A local user with access to the DRM device node can submit crafted decode requests that pass validation while inducing out-of-bounds accesses in kernel-controlled memory. Successful exploitation impacts kernel confidentiality, integrity, and availability.
Root Cause
The root cause is twofold. First, the size calculation referenced width instead of pitch, ignoring row-stride padding enforced by the hardware. Second, no upper bound existed on pitch, permitting values that could overflow arithmetic during size computation. The fix in commit b41c8cb12e202b220353332ab87dc01a11f69304 uses pitch and rejects pitch values greater than 4096 to eliminate the overflow condition.
Attack Vector
Exploitation requires local access and the ability to open the DRM render node associated with an AMD GPU. Any process with permission to submit UVD decode command streams can trigger the flawed validation. Sandboxed processes, container workloads, and multi-tenant systems with GPU passthrough increase the attack surface. See the fix commits including Linux Kernel Commit b8bb9ba and Linux Kernel Commit d058f7a for the code-level changes.
No verified exploitation code is publicly available. The vulnerability mechanism is documented in the upstream commit history referenced above.
Detection Methods for CVE-2026-80540
Indicators of Compromise
- Kernel oops or panic messages referencing amdgpu and UVD decode paths in dmesg or /var/log/kern.log
- Unexpected process terminations or GPU resets on systems running AMD UVD-capable hardware
- Anomalous processes accessing /dev/dri/renderD* nodes outside of expected media or graphics workloads
Detection Strategies
- Compare the running kernel version against the patched builds referenced in the upstream stable commits
- Audit userland processes invoking DRM_IOCTL_AMDGPU_CS ioctls with UVD contexts, particularly from non-graphical services
- Correlate GPU driver crash telemetry with process ancestry to identify attempts to trigger the flaw
Monitoring Recommendations
- Enable kernel auditd rules to log access to DRM render nodes by unexpected UIDs or container workloads
- Monitor for repeated amdgpu driver resets or ring timeouts, which may indicate exploitation attempts
- Ingest kernel logs into a centralized SIEM and alert on amdgpu fault signatures
How to Mitigate CVE-2026-80540
Immediate Actions Required
- Update to a Linux kernel release that includes the backported fix from commit b41c8cb12e202b220353332ab87dc01a11f69304
- Inventory all systems with AMD GPUs and confirm which distributions have shipped the patched kernel
- Restrict access to /dev/dri/renderD* to trusted user groups until patches are deployed
Patch Information
The upstream fix is available across multiple stable branches. Refer to the mainline and stable commits: Linux Kernel Commit 25ee120, Linux Kernel Commit 271a7da, Linux Kernel Commit 5cbd8af, Linux Kernel Commit 60539d5, Linux Kernel Commit b7549e3, Linux Kernel Commit b8bb9ba, Linux Kernel Commit bc7397a, and Linux Kernel Commit d058f7a. Apply the vendor-provided kernel package that corresponds to your distribution's supported branch.
Workarounds
- Blacklist the amdgpu UVD module on systems that do not require hardware video decode acceleration
- Tighten permissions on /dev/dri/renderD* to prevent unprivileged and container workloads from submitting decode command streams
- Disable GPU passthrough to untrusted virtual machines and containers until the patched kernel is deployed
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
