CVE-2026-68229
Description
In the Linux kernel, the following vulnerability has been resolved: media: cedrus: skip invalid H.264 reference list entries Cedrus consumes H.264 ref_pic_list0/ref_pic_list1 entries from the stateless slice control and later uses their indices to look up decode->dpb[] in _cedrus_write_ref_list(). Rejecting such controls in cedrus_try_ctrl() would break existing userspace, since stateless H.264 reference lists may legitimately carry out-of-range indices for missing references. Instead, guard the actual DPB lookup in Cedrus and skip entries whose indices do not fit the fixed V4L2_H264_NUM_DPB_ENTRIES array. This keeps the fix local to the driver use site and avoids out-of-bounds reads from malformed or unsupported reference list entries.
How to fix
- Linux Linuxa6a109771c51920beb620f30778c29da823cc34c, 7ff6f728a2433b420bb372cb0e8a4eea3f2e1a4b, 1db34683b0fbbcb3bc162380c11514ea0a44e8ab, 2ee8327c85b3ac7b532d2d6a1e3a295d5ad7414a, 0af8945fcae742d099f59f3c725eb67235953a31, 9924cb548ee7753a6473997949c3ec48092de0b0, e53112c2de88982e66c369aee2120d5efd78df30, 10358ea986c3c85516d1c8206486464f79d36e76 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | e000e1fa4bdbd783149e7f97cf3be61e1c0bab8c ≤ v < a6a109771c51920beb620f30778c29da823cc34c, e000e1fa4bdbd783149e7f97cf3be61e1c0bab8c ≤ v < 7ff6f728a2433b420bb372cb0e8a4eea3f2e1a4b, e000e1fa4bdbd783149e7f97cf3be61e1c0bab8c ≤ v < 1db34683b0fbbcb3bc162380c11514ea0a44e8ab, e000e1fa4bdbd783149e7f97cf3be61e1c0bab8c ≤ v < 2ee8327c85b3ac7b532d2d6a1e3a295d5ad7414a, e000e1fa4bdbd783149e7f97cf3be61e1c0bab8c ≤ v < 0af8945fcae742d099f59f3c725eb67235953a31, e000e1fa4bdbd783149e7f97cf3be61e1c0bab8c ≤ v < 9924cb548ee7753a6473997949c3ec48092de0b0, e000e1fa4bdbd783149e7f97cf3be61e1c0bab8c ≤ v < e53112c2de88982e66c369aee2120d5efd78df30, e000e1fa4bdbd783149e7f97cf3be61e1c0bab8c ≤ v < 10358ea986c3c85516d1c8206486464f79d36e76, 5.10 | a6a109771c51920beb620f30778c29da823cc34c, 7ff6f728a2433b420bb372cb0e8a4eea3f2e1a4b, 1db34683b0fbbcb3bc162380c11514ea0a44e8ab, 2ee8327c85b3ac7b532d2d6a1e3a295d5ad7414a, 0af8945fcae742d099f59f3c725eb67235953a31, 9924cb548ee7753a6473997949c3ec48092de0b0, e53112c2de88982e66c369aee2120d5efd78df30, 10358ea986c3c85516d1c8206486464f79d36e76 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.