CVE-2026-80909: Linux Kernel AMDGPU UVD Buffer Vulnerability

CVE-2026-80909 Overview

CVE-2026-80909 is a Linux kernel vulnerability in the AMD GPU (amdgpu) driver's Unified Video Decoder (UVD) subsystem. The flaw allows userspace to submit a UVD message specifying an invalid number of H.265 reference frames. Without validation, this value later triggers an integer overflow when the driver calculates the minimum Decoded Picture Buffer (DPB) size. The fix mirrors an earlier H.264 hardening change, rejecting UVD messages with invalid reference counts before they reach size arithmetic.

Critical Impact
A local user with access to the DRM render node can craft UVD submissions that overflow DPB size calculations, potentially leading to memory corruption or denial of service in the kernel graphics stack.

Affected Products

Linux kernel branches containing the amdgpu UVD H.265 message-handling code prior to the referenced stable commits
Distributions shipping AMD GPU-enabled kernels built from affected upstream trees
Systems using AMD hardware with UVD-based video decode acceleration

Discovery Timeline

2026-09-04 - CVE-2026-80909 published to the National Vulnerability Database (NVD)
2026-09-07 - Last updated in NVD database

Technical Details for CVE-2026-80909

Vulnerability Analysis

The vulnerability resides in the amdgpu DRM driver path that parses UVD messages submitted from userspace. When a message describes an H.265 decode session, the driver reads the number of reference frames and later multiplies that count against per-reference buffer sizes to compute the minimum DPB allocation. If the reference count is not bounded, the product can wrap past the representable integer range.

The patched code adds a validation step that rejects UVD messages carrying an invalid number of H.265 references. It mirrors the equivalent guard previously introduced for H.264 streams. Backport commits 0acdf1a575f5, 1facad2a78c1, 2abcdc5f7385, 499907e5d46e, 9fca434208f1, a930c54cb672, cbf1c84bf5ca, and e304c3e0d9ce propagate the fix across supported stable branches.

Root Cause

The root cause is missing input validation on an attacker-controlled field within UVD command buffers. The reference count is trusted and consumed directly in size arithmetic, producing an integer overflow when unusually large values are supplied. This condition matches the pattern described in [CWE-190: Integer Overflow or Wraparound] combined with improper input validation.

Attack Vector

An attacker requires local access to the DRM render node (typically /dev/dri/renderD*), which is available to any user in the render group or to unprivileged containers exposing GPU devices. By submitting a crafted UVD H.265 message, a local user can trigger the overflow inside the kernel amdgpu driver. The resulting undersized DPB allocation may lead to out-of-bounds memory access, kernel memory corruption, or a decoder-side denial of service depending on downstream consumers of the miscalculated size.

No exploitation code is publicly linked in the advisory data, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. See the upstream fix commits such as Kernel Patch e304c3e0d9ce for the exact code change.

Detection Methods for CVE-2026-80909

Indicators of Compromise

Kernel log messages from the amdgpu driver rejecting UVD messages after the patch is applied, indicating attempted submission of invalid H.265 reference counts
Unexpected amdgpu errors, GPU resets, or decoder faults on hosts running unpatched kernels
Non-media workloads or unprivileged processes opening /dev/dri/renderD* and issuing UVD ioctls

Detection Strategies

Inventory running kernel versions and compare against the fixed stable commits listed in the kernel.org references
Audit which local users, groups, and container workloads have access to DRM render nodes on AMD-equipped hosts
Monitor dmesg and journald for amdgpu UVD-related warnings, oopses, or repeated decode failures that could indicate probing

Monitoring Recommendations

Collect kernel logs centrally and alert on amdgpu faults, GPU hangs, or DPB-related errors
Track process execution and file access to /dev/dri/renderD* on servers and workstations with AMD GPUs
Use EDR telemetry to flag unexpected local processes performing GPU ioctls outside of known media applications

How to Mitigate CVE-2026-80909

Immediate Actions Required

Update to a Linux kernel that includes one of the fix commits referenced in the kernel.org stable tree entries
Restrict access to /dev/dri/renderD* to trusted users and remove unnecessary users from the render group
Review container and virtualization configurations that pass GPU devices into untrusted workloads

Patch Information

The fix is committed upstream and backported across stable branches. Reference commits include 0acdf1a575f5, 1facad2a78c1, 2abcdc5f7385, 499907e5d46e, 9fca434208f1, a930c54cb672, cbf1c84bf5ca, and e304c3e0d9ce. Apply the distribution kernel update that incorporates these commits.

Workarounds

Where GPU-accelerated video decode is not required, unload the amdgpu UVD functionality or blacklist the module on affected systems
Tighten permissions on /dev/dri/renderD* so only vetted service accounts can submit UVD commands
Avoid granting GPU device passthrough to untrusted containers or multi-tenant workloads until patched kernels are deployed

bash

# Verify running kernel and restrict render node access
uname -r
ls -l /dev/dri/renderD*
# Example: restrict render node to a dedicated group
sudo chown root:trusted-render /dev/dri/renderD128
sudo chmod 660 /dev/dri/renderD128