CVE-2026-80540

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:LAttack vector, local

Reachable only via AMDGPU_CS ioctl on a local DRM render node (/dev/dri/renderD*), through amdgpu_cs_ioctl → amdgpu_cs_patch_ibs → amdgpu_uvd_ring_parse_cs → amdgpu_uvd_cs_pass2 → amdgpu_uvd_cs_msg → amdgpu_uvd_cs_msg_decode; not reachable from any network-facing kernel service.

AC:LAttack complexity, low

An attacker with render-node access fully controls UVD decode message fields (width, height, pitch in msg[28], stream_type) in their own BO and can reliably set pitch > width (only width > pitch was rejected) to force an underestimated buf_sizes[0x2] check.

PR:LPrivileges required, low

Exploitation requires only standard unprivileged local access to the AMDGPU DRM render node (DRM_AUTH|DRM_RENDER_ALLOW on AMDGPU_CS ioctl), not real root; user namespaces alone do not grant render-node access.

UI:NUser interaction, none

No victim interaction is required; a local attacker can directly craft and submit a UVD command stream with a decode message via AMDGPU_CS ioctl after creating a valid UVD session handle.

S:UScope, unchanged

Impact is confined to the kernel/GPU driver on the local host (GPU out-of-bounds access within the attacker's DRM client address space); it does not cross VM, IOMMU, or sandbox boundaries to a different security authority.

C:HConfidentiality impact, high

Underestimating the decode image minimum size lets undersized buffers pass amdgpu_uvd_cs_pass2 validation while the UVD engine decodes using pitch stride, enabling out-of-bounds reads of adjacent GPU-mapped memory that may contain sensitive data.

I:HIntegrity impact, high

Using image_size (width-based) instead of (pitch*height)*3/2 for buf_sizes[0x2] allows the UVD hardware to perform large out-of-bounds writes past the validated buffer when pitch exceeds width, corrupting adjacent GPU-mapped memory.

A:HAvailability impact, high

Large GPU out-of-bounds writes from the UVD decode engine can hang or reset the GPU driver and may trigger kernel oops/panic; unbounded pitch before the fix also risked integer overflow wrapping the minimum size to near-zero, amplifying corruption.