Incorrect Calculation of Buffer Size in Linux kernel - CVE-2026-80907

Vulnerability identifier: #VU147199

CSH Severity: Low

CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-80907

CWE-ID: CWE-131

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an incorrect calculation of the decoded picture buffer minimum size in the amdgpu UVD H.264 decode message handler when processing H.264 decode messages. A local user can submit a crafted H.264 decode message to cause a denial of service.

Linux kernel
Ubuntu
linux (Ubuntu package)
linux-aws (Ubuntu package)
linux-gcp (Ubuntu package)
linux-oracle (Ubuntu package)
linux-ibm (Ubuntu package)
linux-hwe-7.0 (Ubuntu package)
linux-oem-7.0 (Ubuntu package)

Install security update from vendor's repository.

linux (Ubuntu package) - update to 7.0.0-42.42
linux-aws (Ubuntu package) - update to 7.0.0-1016.17
linux-gcp (Ubuntu package) - update to 7.0.0-1016.18
linux-oracle (Ubuntu package) - update to 7.0.0-1015.16
linux-ibm (Ubuntu package) - update to 7.0.0-1017.17
linux-hwe-7.0 (Ubuntu package) - update to 7.0.0-42.42~24.04.1
linux-oem-7.0 (Ubuntu package) - update to 7.0.0-1017.17

• https://git.kernel.org/stable/c/21a8084cd76223a13493237e04d45f5226d7cee6
• https://git.kernel.org/stable/c/33f4ef585368fe93523dca1e5440e006f6e5146e
• https://git.kernel.org/stable/c/38914cb2c6afb5fe00241ea3438e655822196378
• https://git.kernel.org/stable/c/fa96c24485942e277483cc70d9551d9e0111d7c5
• https://git.kernel.org/stable/c/ff4361816b6ba4bd29b548b17d993056a1ae2502

• Incorrect Calculation of Buffer Size in Linux kernel amd amdgpu driver
• Ubuntu update for linux-oem-7.0
• Ubuntu update for linux, linux-aws, linux-gcp and more