---
id: CVE-2026-80907
title: 'drm/amdgpu: Fix UVD dpb min size calculation for H264'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  drm/amdgpu: Fix UVD dpb min size calculation for H264

  This should use actual number of references from the decode
  message, instead of maximum derived from level.

  (che…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= d38ceaf99ed015f2a0b9af3499791bd3a3daae21 <
    dfd3ccdd77363a3e3e0ea7babd932c3966f0aef8
  - >-
    Linux >= d38ceaf99ed015f2a0b9af3499791bd3a3daae21 <
    fa96c24485942e277483cc70d9551d9e0111d7c5
  - >-
    Linux >= d38ceaf99ed015f2a0b9af3499791bd3a3daae21 <
    33f4ef585368fe93523dca1e5440e006f6e5146e
  - >-
    Linux >= d38ceaf99ed015f2a0b9af3499791bd3a3daae21 <
    38914cb2c6afb5fe00241ea3438e655822196378
  - >-
    Linux >= d38ceaf99ed015f2a0b9af3499791bd3a3daae21 <
    ff4361816b6ba4bd29b548b17d993056a1ae2502
  - >-
    Linux >= d38ceaf99ed015f2a0b9af3499791bd3a3daae21 <
    21a8084cd76223a13493237e04d45f5226d7cee6
  - Linux 4.2
published: '2026-09-04'
updated: '2026-10-30'
sourceUpdated: '2026-10-30T12:31:25.612Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-80907'
references:
  - url: 'https://git.kernel.org/stable/c/dfd3ccdd77363a3e3e0ea7babd932c3966f0aef8'
  - url: 'https://git.kernel.org/stable/c/fa96c24485942e277483cc70d9551d9e0111d7c5'
  - url: 'https://git.kernel.org/stable/c/33f4ef585368fe93523dca1e5440e006f6e5146e'
  - url: 'https://git.kernel.org/stable/c/38914cb2c6afb5fe00241ea3438e655822196378'
  - url: 'https://git.kernel.org/stable/c/ff4361816b6ba4bd29b548b17d993056a1ae2502'
  - url: 'https://git.kernel.org/stable/c/21a8084cd76223a13493237e04d45f5226d7cee6'
tags:
  - cve.org
epss: 0.00161
epssPercentile: 0.0529
ingestedAt: '2026-11-05T15:02:32.626Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: Fix UVD dpb min size calculation for H264

This should use actual number of references from the decode
message, instead of maximum derived from level.

(cherry picked from commit 64b525edb7e7bdfcdc77883c5e413804e2396856)

## Affected

- `Linux >= d38ceaf99ed015f2a0b9af3499791bd3a3daae21 < dfd3ccdd77363a3e3e0ea7babd932c3966f0aef8`
- `Linux >= d38ceaf99ed015f2a0b9af3499791bd3a3daae21 < fa96c24485942e277483cc70d9551d9e0111d7c5`
- `Linux >= d38ceaf99ed015f2a0b9af3499791bd3a3daae21 < 33f4ef585368fe93523dca1e5440e006f6e5146e`
- `Linux >= d38ceaf99ed015f2a0b9af3499791bd3a3daae21 < 38914cb2c6afb5fe00241ea3438e655822196378`
- `Linux >= d38ceaf99ed015f2a0b9af3499791bd3a3daae21 < ff4361816b6ba4bd29b548b17d993056a1ae2502`
- `Linux >= d38ceaf99ed015f2a0b9af3499791bd3a3daae21 < 21a8084cd76223a13493237e04d45f5226d7cee6`
- `Linux 4.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.