CVE-2026-80909 drm/amdgpu: Reject UVD message with invalid number of h265 refs

Not scored Published 4 Sep 2026 Updated 7 Sep 2026

A local attacker can trigger an integer overflow in the AMD GPU driver by sending a malformed UVD message, potentially causing a system crash.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2026-80909?

CVE-2026-80909 is a vulnerability in Linux, published on 4 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: Reject UVD message with invalid number of h265 refs

Same change as for h264, avoids overflow later when calculating min dpb size.

(cherry picked from commit a4b0720e4f1601f97f59a2be9c1b4b94fa6527d5)

Which versions are affected by CVE-2026-80909?

How do I fix CVE-2026-80909?

Apply the vendor's patch.

Is CVE-2026-80909 being exploited?

There is no known exploitation of CVE-2026-80909 in the wild and no public exploit code.

Sources

Also known as AZL-99636, BELL-CVE-2026-80909, DEBIAN-CVE-2026-80909, GHSA-mwhp-jqg6-x3rm, UBUNTU-CVE-2026-80909.