CVE-2026-80540 drm/amdgpu: Fix UVD decode image min size calculation
An integer overflow in the AMD GPU UVD driver allows attackers to cause denial of service or potentially execute code via crafted image sizes.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-80540?
CVE-2026-80540 is a high-severity vulnerability in Linux, published on 26 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: Fix UVD decode image min size calculation
This needs to use pitch instead of width. Also reject pitch over 4096 to avoid overflow.
(cherry picked from commit b41c8cb12e202b220353332ab87dc01a11f69304)
Which versions are affected by CVE-2026-80540?
How do I fix CVE-2026-80540?
Apply the vendor's patch.
Is CVE-2026-80540 being exploited?
There is no known exploitation of CVE-2026-80540 in the wild and no public exploit code.
Sources
Also known as AZL-97727, BELL-CVE-2026-80540, DEBIAN-CVE-2026-80540, GHSA-6g4g-qg49-hpx9, UBUNTU-CVE-2026-80540.