← All Advisories

Linux Kernel V4L2 HEVC SPS Control Accepts Out-of-Range RPS Counts, Exposing Decoder Drivers to Out-of-Bounds Indexing

Last refreshed2026-09-29

Status: NEW  |  Advisory ID: CVE-2026-89873

Key Details

CVECVE-2026-89873
CVSS Score / Version7.8 (High) / CVSS v3.1
Updated2026-09-16
CVSS VectorCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS Proseattack vector is local; attack complexity is low; privileges required is low; user interaction is none; scope is unchanged; confidentiality impact is high; integrity impact is high; availability impact is high.

What to Know

In the Linux kernel, the following vulnerability has been resolved:

media: v4l2-ctrls: validate HEVC EXT SPS RPS counts

The HEVC SPS control carries the short-term and long-term RPS counts

that decoder drivers use to walk the matching EXT SPS dynamic arrays.

Reject SPS values that exceed the HEVC limits of 64 short-term sets and

32 long-term references so drivers cannot later index beyond those

controls.

Also reject EXT SPS ST RPS entries whose negative or positive picture

counts exceed the 16-entry arrays, or whose combined delta-POC count

exceeds the HEVC DPB maximum. (NVD)

References

SourceReference
NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-89873
CVEhttps://www.cve.org/CVERecord?id=CVE-2026-89873