{"cve":"CVE-2026-80909","nvd":{"published":"2026-09-04T18:18:00.640","modified":"2026-09-07T15:17:33.720","status":"Received","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: Reject UVD message with invalid number of h265 refs\n\nSame change as for h264, avoids overflow later when calculating\nmin dpb size.\n\n(cherry picked from commit a4b0720e4f1601f97f59a2be9c1b4b94fa6527d5)","cvss_v4":null,"cvss_v3":null,"cwes":[],"references":["https://git.kernel.org/stable/c/0acdf1a575f59bd46717d5c487d84575af5bee8f","https://git.kernel.org/stable/c/1facad2a78c1a8aeecc36eb4d560c7f1e10ce198","https://git.kernel.org/stable/c/2abcdc5f738574e7fcdd9417575dffb877fdc26f","https://git.kernel.org/stable/c/499907e5d46e575e96967c0230a0a6af980a17ab","https://git.kernel.org/stable/c/9fca434208f1f9ab977feac62df8ebb1cc7ce893"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:52:03.409947763+00:00"},"epss":{"cve":"CVE-2026-80909","score":0.00165,"percentile":0.0566,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}