Linux Kernel amdgpu: Overflow from Invalid H265 UVD Ref Count
CVE-2026-80909 Published on September 4, 2026
drm/amdgpu: Reject UVD message with invalid number of h265 refs
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: Reject UVD message with invalid number of h265 refs
Same change as for h264, avoids overflow later when calculating
min dpb size.
(cherry picked from commit a4b0720e4f1601f97f59a2be9c1b4b94fa6527d5)
Products Associated with CVE-2026-80909
Want to know whenever a new CVE is published for Linux Kernel? stack.watch will email you.
Affected Versions
Linux:- Version 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 and below 1facad2a78c1a8aeecc36eb4d560c7f1e10ce198 is affected.
- Version 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 and below 499907e5d46e575e96967c0230a0a6af980a17ab is affected.
- Version 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 and below cbf1c84bf5cac2b3742ea3d2085fa713424465cc is affected.
- Version 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 and below a930c54cb67200de8bc0de87480d09ece7dcd85d is affected.
- Version 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 and below 2abcdc5f738574e7fcdd9417575dffb877fdc26f is affected.
- Version 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 and below e304c3e0d9ce251887be1f274aa0ed52219d5fd7 is affected.
- Version 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 and below 0acdf1a575f59bd46717d5c487d84575af5bee8f is affected.
- Version 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 and below 9fca434208f1f9ab977feac62df8ebb1cc7ce893 is affected.
- Before 5.10.266 is affected.
- Before 5.15.217 is affected.
- Before 6.1.184 is affected.
- Before 6.6.153 is affected.
- Before 6.12.105 is affected.
- Before 6.18.46 is affected.
- Before 7.1.10 is affected.
- Version 5.10.266, <= 5.10.* is unaffected.
- Version 5.15.217, <= 5.15.* is unaffected.
- Version 6.1.184, <= 6.1.* is unaffected.
- Version 6.6.153, <= 6.6.* is unaffected.
- Version 6.12.105, <= 6.12.* is unaffected.
- Version 6.18.46, <= 6.18.* is unaffected.
- Version 7.1.10, <= 7.1.* is unaffected.
- Version 7.2, <= * is unaffected.