HIGH Introduced in 7.0
v4l2-ctrls HEVC SPS OOB
CVE-2026-89873
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI7.8HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: media: v4l2-ctrls: validate HEVC EXT SPS RPS counts The HEVC SPS control carries the short-term and long-term RPS counts that decoder drivers use to walk the matching EXT SPS dynamic arrays. Reject SPS values that exceed the HEVC limits of 64 short-term sets and 32 long-term references so drivers cannot later index beyond those controls. Also reject EXT SPS ST RPS entries whose negative or positive picture counts exceed the 16-entry arrays, or whose combined delta-POC count exceeds the HEVC DPB maximum.
02KernelScan AI Analysis
Risk summary
A local user with access to a V4L2 video device that supports HEVC decoding can submit crafted HEVC SPS control values with reference picture set counts exceeding spec limits. Drivers use these counts to index into fixed-size arrays, causing out-of-bounds memory access that can leak kernel data, corrupt memory, or crash the system. Any system exposing a hardware HEVC video decoder to untrusted users is at risk.
Vulnerability analysis
The V4L2 control validation framework accepts HEVC SPS parameters without checking that the short-term and long-term reference picture set counts stay within the HEVC specification limits. Decoder drivers trust these counts and use them to walk fixed-size arrays, so an attacker who supplies oversized counts can cause the driver to read or write past array bounds in kernel memory. The fix adds bounds checks that reject SPS counts exceeding 64 short-term sets or 32 long-term references, and also rejects individual reference picture set entries whose negative or positive picture counts exceed the 16-entry array limit. The vulnerable path is reachable by any local user who can open a V4L2 device node supporting HEVC controls — typically a hardware video decoder such as the Rockchip rkvdec — and submit a crafted control via ioctl.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 7.2 | 7.0 | 7.2.5 | 30f85a7c5911 |
| mainline | 7.0 | 7.3 | 796b5c6d4f16 |