CVE-2026-89882

Last refreshed2026-10-19

Status: UPDATED | Advisory ID: CVE-2026-89882

Key Details

CVE	CVE-2026-89882
CVSS Score / Version	7.8 (High) / CVSS v3.1
Updated	2026-10-19
CVSS Vector	`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`
CVSS Prose	attack vector is local; attack complexity is low; privileges required is low; user interaction is none; scope is unchanged; confidentiality impact is high; integrity impact is high; availability impact is high.
Affected products	Linux Kernel

Vendor	Product	Affected Versions	Patch Status
Linux	Linux Kernel

Vendor

Product

Affected Versions

Patch Status

Linux

Linux Kernel

Subsystems	OT Supporting Infrastructure
Sectors	All Sectors

In the Linux kernel, the following vulnerability has been resolved:

media: rkvdec: hevc: guard INTER_REF_PIC_SET_PRED index underflow

st_ref_pic_set_prediction() computes the reference RPS index as

st_rps_idx - (delta_idx_minus1 + 1) per HEVC spec equation 7-59.

Both operands are u8, so when delta_idx_minus1 + 1 exceeds the

current index the subtraction wraps and the subsequent array access

at calculated_rps_st_sets[ref_rps_idx] reads far out of bounds.

A userspace V4L2 client that can open the RKVDEC m2m decoder can

submit an EXT_SPS_ST_RPS control with INTER_REF_PIC_SET_PRED set

and delta_idx_minus1 crafted to trigger the underflow.

Reject the entry early when the reference index would underflow. (NVD)

Monitor Linux's web page for any future patch releases.

Source	Reference
NVD	https://nvd.nist.gov/vuln/detail/CVE-2026-89882
CVE	https://www.cve.org/CVERecord?id=CVE-2026-89882

Source

Reference

NVD

CVE