What’s Vulnerable › Vulnerabilities

CVE-2026-80909: drm/amdgpu: Reject UVD message with invalid number of h265 refs

• Severity: unknown
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-04 · updated 2026-09-07

Description

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Reject UVD message with invalid number of h265 refs Same change as for h264, avoids overflow later when calculating min dpb size. (cherry picked from commit a4b0720e4f1601f97f59a2be9c1b4b94fa6527d5)

Affected products

• Linux kernel: 4.2 — fixed in 7.2

How to fix

Upgrade to a fixed version: Linux kernel 7.2. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/0acdf1a575f59bd46717d5c487d84575af5bee8f
• https://git.kernel.org/stable/c/1facad2a78c1a8aeecc36eb4d560c7f1e10ce198
• https://git.kernel.org/stable/c/2abcdc5f738574e7fcdd9417575dffb877fdc26f
• https://git.kernel.org/stable/c/499907e5d46e575e96967c0230a0a6af980a17ab
• https://git.kernel.org/stable/c/9fca434208f1f9ab977feac62df8ebb1cc7ce893
• https://git.kernel.org/stable/c/a930c54cb67200de8bc0de87480d09ece7dcd85d
• https://git.kernel.org/stable/c/cbf1c84bf5cac2b3742ea3d2085fa713424465cc
• https://git.kernel.org/stable/c/e304c3e0d9ce251887be1f274aa0ed52219d5fd7

Get alerted when CVE-2026-80909 or the next vulnerability affects your stack