CVE-2026-80907: Linux Kernel UVD DPB Memory Vulnerability

CVE-2026-80907 Overview

CVE-2026-80907 affects the Linux kernel drm/amdgpu driver. The flaw resides in the Unified Video Decoder (UVD) code path that calculates the minimum Decoded Picture Buffer (DPB) size for H.264 video streams. The driver derived the DPB size from the maximum reference count implied by the H.264 level rather than the actual reference count present in the decode message. This mismatch can lead to incorrect buffer sizing during hardware-accelerated video decoding on AMD GPUs. The issue was resolved by cherry-picking upstream commit 64b525edb7e7bdfcdc77883c5e413804e2396856 to stable kernel branches.

Critical Impact
An incorrect DPB minimum size calculation in the amdgpu UVD H.264 path can cause improper memory sizing for hardware video decode, affecting stability and correctness of GPU video workloads on affected Linux systems.

Affected Products

Linux kernel drm/amdgpu driver (UVD H.264 decode path)
Stable Linux kernel branches receiving the backport referenced in commits 21a8084, 33f4ef5, 38914cb, fa96c24, and ff43618
Systems using AMD GPUs with UVD hardware decode for H.264 content

Discovery Timeline

2026-09-04 - CVE-2026-80907 published to NVD
2026-09-07 - Last updated in NVD database

Technical Details for CVE-2026-80907

Vulnerability Analysis

The vulnerability exists in the AMD GPU (amdgpu) Direct Rendering Manager driver's UVD subsystem. When preparing hardware buffers for H.264 decoding, the driver must allocate a DPB large enough to hold reference frames used during decode. The original implementation calculated the minimum DPB size using the maximum number of reference frames permitted by the stream's H.264 level, which overestimates or misaligns the buffer relative to what the decode message actually requires. The fix changes the calculation to use the actual reference count provided in the decode message.

This is a kernel-mode driver correctness issue in a GPU media pipeline. Incorrect buffer sizing in a decode path can lead to memory handling errors during hardware decode operations, resulting in unstable behavior for userspace processes issuing H.264 decode requests through the kernel driver.

Root Cause

The root cause is a logic error in the DPB minimum size calculation. The driver relied on the H.264 profile/level to compute the maximum possible reference count and used that value to size the DPB. The correct approach, applied in commit 64b525edb7e7bdfcdc77883c5e413804e2396856, uses the actual reference count parsed from the decode message provided by userspace media clients.

Attack Vector

The attack surface requires local access to submit UVD decode jobs through the amdgpu driver, typically via a user-space media framework such as VA-API or VDPAU. No CVSS vector, CWE mapping, or exploitation details have been published by upstream at the time of NVD publication. There are no public proof-of-concept exploits associated with this CVE.

See the upstream fix and backports for technical details: Git Kernel Commit 21a8084, Git Kernel Commit 33f4ef5, Git Kernel Commit 38914cb, Git Kernel Commit fa96c24, and Git Kernel Commit ff43618.

Detection Methods for CVE-2026-80907

Indicators of Compromise

No public indicators of compromise are associated with CVE-2026-80907, and no exploitation in the wild has been reported.
Unexpected amdgpu kernel messages related to UVD decode, DPB sizing, or H.264 decode failures may indicate exposure to the underlying defect.

Detection Strategies

Inventory Linux hosts running kernels that predate the backport commits and identify those with AMD GPUs exercising the UVD H.264 decode path.
Compare installed kernel package versions against distribution security advisories that reference the upstream fix commit 64b525edb7e7bdfcdc77883c5e413804e2396856.
Monitor dmesg and journalctl -k for amdgpu UVD warnings emitted when media clients submit H.264 decode workloads.

Monitoring Recommendations

Collect kernel logs centrally and alert on repeated amdgpu decode errors from hosts running vulnerable kernel builds.
Track kernel package versions across the fleet using existing endpoint telemetry and configuration management tooling.
Correlate GPU driver events with process activity to identify workloads that heavily exercise UVD H.264 decode.

How to Mitigate CVE-2026-80907

Immediate Actions Required

Apply the vendor kernel update from your Linux distribution that incorporates the upstream fix for the UVD DPB H.264 calculation.
Prioritize patching on multi-tenant systems, media servers, and workstations that expose GPU decode APIs to untrusted users.
Validate that the running kernel version matches the patched build after reboot.

Patch Information

The upstream fix was cherry-picked from commit 64b525edb7e7bdfcdc77883c5e413804e2396856 and applied to multiple stable branches. Refer to the referenced kernel.org commits (21a8084, 33f4ef5, 38914cb, fa96c24, ff43618) and to your distribution's security tracker for the exact kernel package version that includes the fix.

Workarounds

Where patching is not immediately possible, restrict local user access on systems with AMD GPUs to trusted accounts only.
Disable or avoid H.264 hardware decoding through UVD on affected hosts by configuring media frameworks to use software decode until the kernel is updated.
Reboot into a patched kernel as soon as the distribution package is available; live-patching support depends on your distribution.

bash

# Check running kernel version and AMD GPU presence
uname -r
lspci -k | grep -EA3 'VGA|3D|Display' | grep -i amd

# Example: verify Debian/Ubuntu kernel package includes the fix
apt-cache policy linux-image-$(uname -r)

# Example: verify RHEL/Fedora kernel package version
rpm -q kernel