CVE-2026-89724

Status: UPDATED  |  Advisory ID: CVE-2026-89724

Key Details

Affected Products, Subsystems & Sectors

What to Know

In the Linux kernel, the following vulnerability has been resolved:

media: vicodec: fix out-of-bounds write in FWHT encoder

vidioc_s_fmt_vid_out() sizes the encoder CAPTURE buffer from the

compressed descriptor pixfmt_fwht, whose sizeimage_mult is 3:

coded_w * coded_h * 3 + sizeof(struct fwht_cframe_hdr). fwht_encode_frame()

encodes one plane per component, and an incompressible plane takes the

FWHT_FRAME_UNENCODED path in encode_plane(), copying the plane verbatim.

For a 4-component pixel format all four planes are full resolution

(width_div == height_div == 1), so a frame that forces every plane

through the unencoded fallback writes

sizeof(struct fwht_cframe_hdr) + 4 * coded_w * coded_h bytes, overrunning

the plane by coded_w * coded_h, which can result in corruption

of adjacent kernel heap memory.

Bump pixfmt_fwht.sizeimage_mult from 3 to 4, matching the largest

components_num among the supported raw formats, so the capture buffer is

always large enough for the unencoded fallback. (NVD)

What to Do

Monitor Linux's web page for any future patch releases.

References