CVE-2026-80909

CVE-2026-80909 affects the drm/amdgpu driver in the Linux kernel , specifically the UVD (Unified Video Decoder) subsystem. The vulnerability arises when a UVD message containing an invalid number of H.265 references is not validated, leading to an integer overflow during the subsequent calculatio...

EUVD-2026-71668

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Reject UVD message with invalid number of h265 refs Same change as for h264, avoids overflow later when calculating min dpb size. cherry picked from commit a4b0720e4f1601f97f59a2be9c1b4b94fa6527d5...

CVE-2026-80908 drm/amdgpu: Reject UVD message with dimensions above 4096

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Reject UVD message with dimensions above 4096 Fixes potential overflow in DPB size calculations. cherry picked from commit 05e1387d151f71569fbe122d2c89f9db0c21dc10...

CVE-2026-80908

CVE-2026-80908 affects the Linux kernel drm/amdgpu subsystem. When a UVD (Unified Video Decoder) message with dimensions above 4096 is not rejected, it can trigger a potential overflow in DPB (Decoded Picture Buffer) size calculations . The fix, cherry-picked from upstream commit 05e1387d151f7156...

EUVD-2026-71667

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Reject UVD message with dimensions above 4096 Fixes potential overflow in DPB size calculations. cherry picked from commit 05e1387d151f71569fbe122d2c89f9db0c21dc10...

EUVD-2026-71666

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix UVD dpb min size calculation for H264 This should use actual number of references from the decode message, instead of maximum derived from level. cherry picked from commit 64b525edb7e7bdfcdc77883c5e413804e2396856...

CVE-2026-80907

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix UVD dpb min size calculation for H264 This should use actual number of references from the decode message, instead of maximum derived from level. cherry picked from commit 64b525edb7e7bdfcdc77883c5e413804e2396856...