CVE-2026-80540

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix UVD decode image min size calculation This needs to use pitch instead of width. Also reject pitch over 4096 to avoid overflow. (cherry picked from commit b41c8cb12e202b220353332ab87dc01a11f69304)

CVSS v3 7.8 HIGH

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://git.kernel.org/stable/c/25ee120f3803ad9e416ef9f76f4c3234cc4d645b
https://git.kernel.org/stable/c/271a7da84a6262a09de549912dcf6a749d169cb6
https://git.kernel.org/stable/c/5cbd8af02b0b9c8723fa30edcf6fccab5170af8d
https://git.kernel.org/stable/c/60539d517e8439621532d8c01091ac049c596b4b
https://git.kernel.org/stable/c/b7549e3f96c78921751c4b3e69af729662130d83
https://git.kernel.org/stable/c/b8bb9ba3f101a1b0011f785a577a4a0a38371174
https://git.kernel.org/stable/c/bc7397a033ac52f6d8c9bb6510d61694b2a3fce7
https://git.kernel.org/stable/c/d058f7a6709441afe1784eecd8c0643dd84750bc

Configurations

No configuration.

History

No history.

Information

Published : 2026-08-26 15:17

Updated : 2026-08-27 06:17

NVD link : CVE-2026-80540

Mitre link : CVE-2026-80540

CVE.ORG link : CVE-2026-80540

JSON object : View

Products Affected

No product.

CWE

No CWE.

{"id": "CVE-2026-80540", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "d38ceaf99ed015f2a0b9af3499791bd3a3daae21", "lessThan": "bc7397a033ac52f6d8c9bb6510d61694b2a3fce7", "versionType": "git"}, {"status": "affected", "version": "d38ceaf99ed015f2a0b9af3499791bd3a3daae21", "lessThan": "d058f7a6709441afe1784eecd8c0643dd84750bc", "versionType": "git"}, {"status": "affected", "version": "d38ceaf99ed015f2a0b9af3499791bd3a3daae21", "lessThan": "b7549e3f96c78921751c4b3e69af729662130d83", "versionType": "git"}, {"status": "affected", "version": "d38ceaf99ed015f2a0b9af3499791bd3a3daae21", "lessThan": "60539d517e8439621532d8c01091ac049c596b4b", "versionType": "git"}, {"status": "affected", "version": "d38ceaf99ed015f2a0b9af3499791bd3a3daae21", "lessThan": "271a7da84a6262a09de549912dcf6a749d169cb6", "versionType": "git"}, {"status": "affected", "version": "d38ceaf99ed015f2a0b9af3499791bd3a3daae21", "lessThan": "25ee120f3803ad9e416ef9f76f4c3234cc4d645b", "versionType": "git"}, {"status": "affected", "version": "d38ceaf99ed015f2a0b9af3499791bd3a3daae21", "lessThan": "5cbd8af02b0b9c8723fa30edcf6fccab5170af8d", "versionType": "git"}, {"status": "affected", "version": "d38ceaf99ed015f2a0b9af3499791bd3a3daae21", "lessThan": "b8bb9ba3f101a1b0011f785a577a4a0a38371174", "versionType": "git"}], "programFiles": ["drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "4.2"}, {"status": "unaffected", "version": "0", "lessThan": "4.2", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.266", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.217", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.184", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.153", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.105", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.46", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.1.10", "versionType": "semver", "lessThanOrEqual": "7.1.*"}, {"status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c"], "defaultStatus": "affected"}]}], "published": "2026-08-26T15:17:08.257", "references": [{"url": "https://git.kernel.org/stable/c/25ee120f3803ad9e416ef9f76f4c3234cc4d645b", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/271a7da84a6262a09de549912dcf6a749d169cb6", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/5cbd8af02b0b9c8723fa30edcf6fccab5170af8d", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/60539d517e8439621532d8c01091ac049c596b4b", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/b7549e3f96c78921751c4b3e69af729662130d83", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/b8bb9ba3f101a1b0011f785a577a4a0a38371174", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/bc7397a033ac52f6d8c9bb6510d61694b2a3fce7", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/d058f7a6709441afe1784eecd8c0643dd84750bc", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Received", "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: Fix UVD decode image min size calculation\n\nThis needs to use pitch instead of width. Also reject pitch\nover 4096 to avoid overflow.\n\n(cherry picked from commit b41c8cb12e202b220353332ab87dc01a11f69304)"}], "lastModified": "2026-08-27T06:17:34.813", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}