CVE-2026-89882
Description
In the Linux kernel, the following vulnerability has been resolved: media: rkvdec: hevc: guard INTER_REF_PIC_SET_PRED index underflow st_ref_pic_set_prediction() computes the reference RPS index as st_rps_idx - (delta_idx_minus1 + 1) per HEVC spec equation 7-59. Both operands are u8, so when delta_idx_minus1 + 1 exceeds the current index the subtraction wraps and the subsequent array access at calculated_rps_st_sets[ref_rps_idx] reads far out of bounds. A userspace V4L2 client that can open the RKVDEC m2m decoder can submit an EXT_SPS_ST_RPS control with INTER_REF_PIC_SET_PRED set and delta_idx_minus1 crafted to trigger the underflow. Reject the entry early when the reference index would underflow.
How to fix
- Linux Linux74938f83a8abbee8f502dfb5d94213b2497d1edf, 052c5ed5a1d96a6b24fd50ccda16fc6841ee7ca3 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | c9a59dc2acc72789d5c778af080d1e65af84862c ≤ v < 74938f83a8abbee8f502dfb5d94213b2497d1edf, c9a59dc2acc72789d5c778af080d1e65af84862c ≤ v < 052c5ed5a1d96a6b24fd50ccda16fc6841ee7ca3, 7.0 | 74938f83a8abbee8f502dfb5d94213b2497d1edf, 052c5ed5a1d96a6b24fd50ccda16fc6841ee7ca3 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.