Riskcovery

CVE-2026-89873

media: v4l2-ctrls: validate HEVC EXT SPS RPS counts

State
Published
Severity
7.8 High
Published
Sep 16, 2026
Updated
Oct 19, 2026
Reserved
Sep 11, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

media: v4l2-ctrls: validate HEVC EXT SPS RPS counts

The HEVC SPS control carries the short-term and long-term RPS counts that decoder drivers use to walk the matching EXT SPS dynamic arrays. Reject SPS values that exceed the HEVC limits of 64 short-term sets and 32 long-term references so drivers cannot later index beyond those controls.

Also reject EXT SPS ST RPS entries whose negative or positive picture counts exceed the 16-entry arrays, or whose combined delta-POC count exceeds the HEVC DPB maximum.

Scores

CVSSScoreVectorSource
3.17.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HLinux

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • c9a59dc2acc72789d5c778af080d1e65af84862c to before 30f85a7c59113a8844b276efc010085a34f912e9Affected
  • c9a59dc2acc72789d5c778af080d1e65af84862c to before 796b5c6d4f1615d59d5d8fe5a38fae6bfdfe878eAffected
LinuxLinux
  • 7.0Affected
  • before 7.0Not affected
  • 7.2.5 through 7.2.*Not affected
  • 7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.