The Linux kernel’s DRM amdgpu component accepts an UVD message containing an invalid number of H.265 references. The kernel then proceeds to compute the minimum reference decoding buffer size without first validating the reference count. This unchecked calculation can overflow, corrupt memory, and potentially enable arbitrary code execution or system compromise. The vulnerability is specifically tied to the H.265 decoding path, with a similar fix applied for H.264, indicating that any H.265 or H.264 stream processed by the amdgpu driver could trigger the fault if crafted maliciously.

The flaw resides in the Linux kernel DRM amdgpu driver and affects all systems running kernel versions that have not incorporated the upstream patch that adds validation for the UVD message format. No explicit vendor or version list is provided in the data; however, any distribution shipping a kernel older than the commit that introduced the rejection logic remains susceptible.

The CPE indicates the kernel object; no EPSS or KEV data is available, so the probability of exploitation and real‑world impact are uncertain. By inferring from the nature of the flaw, an attacker would need to supply a crafted UVD payload to the GPU driver, implying either local kernel exploitation or privileged application abuse. At the current moment the vulnerability is considered a medium‑to‑high risk due to the potential for memory corruption, though the lack of CVSS and EPSS figures prevents a precise severity rating.