CVE-2026-80908 Overview
CVE-2026-80908 is a Linux kernel vulnerability in the AMD GPU (amdgpu) driver's Unified Video Decoder (UVD) message handling path. The kernel accepted UVD messages with frame dimensions exceeding 4096 pixels, which could trigger an integer overflow in Decoded Picture Buffer (DPB) size calculations. The fix rejects UVD messages with dimensions above 4096 to prevent the overflow condition. The vulnerability affects multiple stable Linux kernel branches and was resolved through patches cherry-picked from upstream commit 05e1387d151f.
Critical Impact
A local user with access to the amdgpu render node could submit crafted UVD messages that trigger overflow conditions in kernel DPB size calculations, potentially leading to memory corruption or denial of service on affected systems.
Affected Products
- Linux kernel with the amdgpu DRM driver enabled
- Systems using AMD GPUs that expose UVD hardware acceleration
- Multiple stable kernel branches referenced by the eight backport commits
Discovery Timeline
- 2026-09-04 - CVE-2026-80908 published to the National Vulnerability Database
- 2026-09-07 - Last updated in NVD database
Technical Details for CVE-2026-80908
Vulnerability Analysis
The vulnerability resides in the amdgpu driver's UVD message processing logic. UVD messages describe video frames to be decoded, including frame width and height. The driver uses these dimensions to compute the required Decoded Picture Buffer size for the decoder session.
When dimensions exceeding 4096 pixels are provided, the multiplication used in DPB size arithmetic can overflow the integer type used to hold the result. An overflow produces an undersized allocation while subsequent code paths still treat the buffer as large enough for the requested frame, creating a boundary mismatch between allocation size and expected usage.
The upstream fix, backported through commits including 17fbb99, 339deb7, 382bef7, 8435d41, 8bae80e, 8c9aebc, 9adc5e2, and f7af372, adds an explicit validation step. UVD messages carrying dimensions above 4096 are rejected before reaching the DPB calculation. This eliminates the arithmetic path that produces the overflow.
Root Cause
The root cause is missing input validation on width and height fields carried in UVD messages before they participate in size arithmetic. Without an upper bound check, attacker-influenced dimensions drive an integer overflow in DPB size computation inside the kernel driver.
Attack Vector
Exploitation requires local access to the AMD GPU render node exposed by the amdgpu driver. An unprivileged process with permission to submit command streams can craft a UVD message specifying oversized dimensions. Because access to render nodes is often granted to graphical sessions and container workloads, the effective attack surface extends beyond dedicated video decoding applications.
See the upstream fix for technical details: Linux Kernel Commit 382bef7.
Detection Methods for CVE-2026-80908
Indicators of Compromise
- Kernel log entries from the amdgpu driver indicating rejected UVD messages after patching, which may reveal prior probing attempts
- Unexpected GPU resets, hangs, or amdgpu driver oops messages in dmesg on unpatched kernels
- Processes invoking ioctl on /dev/dri/renderD* with unusual UVD command payloads from non-media workloads
Detection Strategies
- Monitor kernel ring buffer output for amdgpu warnings and UVD-related error strings correlated with process identifiers
- Audit which local users and containers hold access to DRM render nodes and correlate against expected media workloads
- Track kernel version and build identifiers across the fleet to identify hosts still running vulnerable amdgpu code paths
Monitoring Recommendations
- Ship dmesg and journalctl -k output to a central log store and alert on amdgpu fault, reset, or UVD parse failure patterns
- Include GPU driver version in host inventory data to prioritize patch verification
- Alert on unexpected processes opening /dev/dri/renderD* outside sanctioned video or compute workloads
How to Mitigate CVE-2026-80908
Immediate Actions Required
- Apply the vendor-supplied kernel update from your Linux distribution that incorporates the amdgpu UVD dimension check
- Reboot affected hosts after installing the updated kernel package so the patched driver is loaded
- Inventory systems using AMD GPUs and prioritize multi-tenant hosts, workstations shared by multiple users, and container hosts
Patch Information
The fix is available in upstream Linux stable trees through the following backport commits: 17fbb99, 339deb7, 382bef7, 8435d41, 8bae80e, 8c9aebc, 9adc5e2, and f7af372. Consume the fix through your distribution's stable kernel package rather than applying commits directly in production.
Workarounds
- Restrict access to /dev/dri/renderD* device nodes to trusted users and service accounts only, tightening group membership and container device passthrough
- Where video decode acceleration is not required, unload or blacklist the amdgpu UVD codepath by disabling hardware video acceleration in userspace media stacks
- Isolate untrusted workloads from hosts with AMD GPUs until the patched kernel is deployed
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
