HIGH Introduced in 7.0
rkvdec HevcRps OOB
CVE-2026-89882
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI7.3HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: media: rkvdec: hevc: guard INTER_REF_PIC_SET_PRED index underflow st_ref_pic_set_prediction() computes the reference RPS index as st_rps_idx - (delta_idx_minus1 + 1) per HEVC spec equation 7-59. Both operands are u8, so when delta_idx_minus1 + 1 exceeds the current index the subtraction wraps and the subsequent array access at calculated_rps_st_sets[ref_rps_idx] reads far out of bounds. A userspace V4L2 client that can open the RKVDEC m2m decoder can submit an EXT_SPS_ST_RPS control with INTER_REF_PIC_SET_PRED set and delta_idx_minus1 crafted to trigger the underflow. Reject the entry early when the reference index would underflow.
02KernelScan AI Analysis
Risk summary
A local user with access to the RKVDEC V4L2 m2m decoder device can submit a crafted HEVC SPS short-term reference picture set control that causes an unsigned integer underflow in the reference RPS index computation, leading to a far out-of-bounds array read. This can be used to disclose kernel memory or crash the kernel, affecting systems exposing the Rockchip hardware decoder to untrusted clients.
Vulnerability analysis
The driver computes an array index for reference picture set prediction by subtracting a user-supplied delta value from the current index using unsigned arithmetic. When the delta exceeds the current index, the subtraction wraps to a very large value and the driver reads far outside the reference picture set array. The fix checks the delta against the current index before the subtraction, rejecting values that would underflow so the out-of-bounds access cannot occur. Any local userspace program that can open the Rockchip video decoder device through the V4L2 interface can trigger the bug by submitting a crafted reference-picture-set control.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 7.2 | 7.0 | 7.2.5 | 74938f83a8ab |
| mainline | 7.0 | 7.3 | 052c5ed5a1d9 |