Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-80909— drm/amdgpu: Reject UVD message with invalid number of h265 refs

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会开源的一个操作系统内核。 Linux kernel存在安全漏洞，该漏洞源于对UVD消息中h265参考帧数量的验证不足，可能导致计算最小dpb大小时发生整数溢出。

AI Predicted 5.5 Difficulty: Moderate EPSS 0.17% · P6

Possible ATT&CK Techniques 1 AI

T1068 · Exploitation for Privilege Escalation

Affected Version Matrix 18

VendorProduct Version RangeStatus
Linux Linux 86fa0bdc6fd7b2debc07ce86f1bcd5fb254822e3< 1facad2a78c1a8aeecc36eb4d560c7f1e10ce198 affected
86fa0bdc6fd7b2debc07ce86f1bcd5fb254822e3< 499907e5d46e575e96967c0230a0a6af980a17ab affected
86fa0bdc6fd7b2debc07ce86f1bcd5fb254822e3< cbf1c84bf5cac2b3742ea3d2085fa713424465cc affected
86fa0bdc6fd7b2debc07ce86f1bcd5fb254822e3< a930c54cb67200de8bc0de87480d09ece7dcd85d affected
86fa0bdc6fd7b2debc07ce86f1bcd5fb254822e3< 2abcdc5f738574e7fcdd9417575dffb877fdc26f affected
86fa0bdc6fd7b2debc07ce86f1bcd5fb254822e3< e304c3e0d9ce251887be1f274aa0ed52219d5fd7 affected
86fa0bdc6fd7b2debc07ce86f1bcd5fb254822e3< 0acdf1a575f59bd46717d5c487d84575af5bee8f affected
86fa0bdc6fd7b2debc07ce86f1bcd5fb254822e3< 9fca434208f1f9ab977feac62df8ebb1cc7ce893 affected
… +10 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-80909

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
drm/amdgpu: Reject UVD message with invalid number of h265 refs
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Reject UVD message with invalid number of h265 refs Same change as for h264, avoids overflow later when calculating min dpb size. (cherry picked from commit a4b0720e4f1601f97f59a2be9c1b4b94fa6527d5)
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会开源的一个操作系统内核。 Linux kernel存在安全漏洞，该漏洞源于对UVD消息中h265参考帧数量的验证不足，可能导致计算最小dpb大小时发生整数溢出。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 86fa0bdc6fd7b2debc07ce86f1bcd5fb254822e3 ~ 1facad2a78c1a8aeecc36eb4d560c7f1e10ce198 -
Linux Linux 4.2 -

II. Public POCs for CVE-2026-80909

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-80909

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-80909 (8)

Same Patch Batch · Linux · 2026-09-04 · 156 CVEs total

CVE-2026-80864 RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp
CVE-2026-80855 fuse: fix invalidate lock leak on open O_TRUNC DAX failure
CVE-2026-80856 fuse: fix invalidate lock leak on setattr writeback failure
CVE-2026-80857 fuse: wait for FR_FINISHED on abort_on_kill to prevent use-after-free
CVE-2026-80858 fuse: publish io-uring queues with release semantics
CVE-2026-80859 fuse: fix missing barrier when checking io-uring readiness
CVE-2026-80860 fuse: fix race between interrupt and resend
CVE-2026-80861 usb: xhci: bail out of setup if the controller is inaccessible
CVE-2026-80862 nvme-tcp: fix usage of page_frag_cache
CVE-2026-80863 RDMA/rxe: Fix OOB in free_rd_atomic_resources()
CVE-2026-80869 ntfs: bound the attribute-list entry in ntfs_read_inode_mount()
CVE-2026-80873 KVM: arm64: nv: Write ESR_EL2 for injected nested SError exceptions
CVE-2026-80872 ALSA: hda/tas2781: Cancel async firmware request at unbind
CVE-2026-80871 crypto: xilinx-trng - Remove crypto_rng interface
CVE-2026-80870 drm/amdkfd: Validate CRIU-restored IDs before idr_alloc
CVE-2026-80867 alpha/PCI: Add security_locked_down() check to pci_mmap_resource()
CVE-2026-80865 bpf: Add missing access_ok call to copy_user_syms
CVE-2026-80866 tipc: avoid busy looping in tipc_exit_net()
CVE-2026-80854 usb: gadget: f_tcm: keep port count until LUN teardown completes
CVE-2026-80868 ntfs3: Allocate iomap inline_data using alloc_page

Showing top 20 of 156 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-80909

No comments yet

Leave a comment