CVE-2026-80909 PUBLISHED

drm/amdgpu: Reject UVD message with invalid number of h265 refs

Assigner: Linux
Reserved: 26.08.2026 Published: 04.09.2026 Updated: 04.09.2026

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: Reject UVD message with invalid number of h265 refs

Same change as for h264, avoids overflow later when calculating min dpb size.

(cherry picked from commit a4b0720e4f1601f97f59a2be9c1b4b94fa6527d5)

Vendor	Linux
Product	Linux
Versions	Default: unaffected affected from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to 1facad2a78c1a8aeecc36eb4d560c7f1e10ce198 (excl.) affected from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to 499907e5d46e575e96967c0230a0a6af980a17ab (excl.) affected from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to cbf1c84bf5cac2b3742ea3d2085fa713424465cc (excl.) affected from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to a930c54cb67200de8bc0de87480d09ece7dcd85d (excl.) affected from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to 2abcdc5f738574e7fcdd9417575dffb877fdc26f (excl.) affected from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to e304c3e0d9ce251887be1f274aa0ed52219d5fd7 (excl.) affected from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to 0acdf1a575f59bd46717d5c487d84575af5bee8f (excl.) affected from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to 9fca434208f1f9ab977feac62df8ebb1cc7ce893 (excl.) affected from 0 to 5.10.266 (excl.) affected from 0 to 5.15.217 (excl.) affected from 0 to 6.1.184 (excl.) affected from 0 to 6.6.153 (excl.) affected from 0 to 6.12.105 (excl.) affected from 0 to 6.18.46 (excl.) affected from 0 to 7.1.10 (excl.)

Vendor	Linux
Product	Linux
Versions	Default: affected unaffected from 5.10.266 to 5.10.* (incl.) unaffected from 5.15.217 to 5.15.* (incl.) unaffected from 6.1.184 to 6.1.* (incl.) unaffected from 6.6.153 to 6.6.* (incl.) unaffected from 6.12.105 to 6.12.* (incl.) unaffected from 6.18.46 to 6.18.* (incl.) unaffected from 7.1.10 to 7.1.* (incl.) unaffected from 7.2 to * (incl.)