Description

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix UVD decode image min size calculation This needs to use pitch instead of width. Also reject pitch over 4096 to avoid overflow. (cherry picked from commit b41c8cb12e202b220353332ab87dc01a11f69304)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-08-26T15:17:08.257Z",
  "pubdate": "2026-08-26T15:17:08.257Z",
  "executiveSummary": "A vulnerability exists in the Linux kernel's AMDGPU driver related to the Universal Video Decoder (UVD) component. The flaw involves improper validation of image dimension parameters during decode operations.\nThe vulnerability allows for a potential integer overflow caused by utilizing the 'width' parameter instead of the 'pitch' for memory calculations, combined with a lack of upper-bound constraints on the pitch size.\nAn unprivileged local attacker could potentially leverage this flaw to trigger memory corruption within the kernel address space. Successful exploitation may result in a kernel panic (Denial of Service) or, depending on the memory layout, arbitrary code execution.\nThe vulnerability impacts systems utilizing the amdgpu driver where UVD-based video decoding is enabled. Risk is concentrated on local users with access to the DRM (Direct Rendering Manager) device nodes, typically found in desktop or workstation environments.\nMitigation requires applying the kernel patch provided in commit b41c8cb12e202b220353332ab87dc01a11f69304 to enforce correct bounds checking on the pitch parameter.",
  "technicalDetails": "The root cause of the vulnerability lies in the incorrect validation logic within the amdgpu UVD command submission path. The kernel driver's image decoding logic was erroneously utilizing the image width to calculate memory requirements, rather than the pitch (stride). In graphical memory management, the pitch accounts for memory alignment and padding, which is consistently greater than or equal to the width.\nBecause the pitch value was not subjected to strict sanitization, a malicious user could provide an excessively large pitch value. When this value is used in internal calculations—such as memory buffer allocations or offset arithmetic—it leads to an integer overflow. An attacker can craft a specific command stream for the UVD hardware to supply an intentionally large pitch, causing the calculation for required buffer size to wrap around.\nThe attack flow proceeds as follows: 1) The attacker opens the DRM device node associated with the AMD GPU. 2) The attacker submits a malformed UVD decode command packet via the amdgpu ioctl interface. 3) Within this packet, the attacker specifies a pitch parameter that exceeds the expected hardware limits (specifically exceeding 4096). 4) The driver, failing to check the upper bound of the pitch, performs arithmetic that results in an integer overflow. 5) This overflow leads to the allocation of a buffer smaller than required by the GPU hardware, causing an out-of-bounds write operation when the UVD hardware processes the decode request.\nThe lack of a 4096-limit check on the pitch parameter allows the attacker to bypass the intended security constraints of the UVD command processor. By providing a crafted pitch, the attacker can force the kernel to miscalculate the necessary memory footprint for the video frame buffer. Subsequent operations by the GPU hardware will then result in writing decoded video data outside of the allocated kernel memory region.\nThis vulnerability is localized to the amdgpu driver's UVD interface. It requires local access to the GPU device nodes, which are generally available to users in the 'video' or 'render' groups. The impact is primarily a kernel-level memory corruption event. Given that GPU command submission occurs through specialized ioctls, successful exploitation requires knowledge of the AMD GPU command submission format and the specific register offsets related to UVD image dimensions.\nThe remediation involves enforcing a strict check on the pitch value during command validation, specifically rejecting any pitch exceeding 4096, and ensuring the correct usage of pitch over width for all downstream allocation and offset calculations."
}