CVE-2026-89873 in Linux
Summary
by MITRE • 09/17/2026
In the Linux kernel, the following vulnerability has been resolved:
media: v4l2-ctrls: validate HEVC EXT SPS RPS counts
The HEVC SPS control carries the short-term and long-term RPS counts that decoder drivers use to walk the matching EXT SPS dynamic arrays. Reject SPS values that exceed the HEVC limits of 64 short-term sets and 32 long-term references so drivers cannot later index beyond those controls.
Also reject EXT SPS ST RPS entries whose negative or positive picture counts exceed the 16-entry arrays, or whose combined delta-POC count exceeds the HEVC DPB maximum.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/17/2026
The Linux kernel media subsystem contains a critical input validation flaw within the V4L2 control handling logic for High Efficiency Video Coding (HEVC) sequences. Specifically, the vulnerability resides in the processing of the Sequence Parameter Set (SPS) controls, which define how video frames are decoded and referenced. The HEVC standard relies on Reference Picture Sets to manage short-term and long-term reference pictures, allowing decoders to reconstruct frame dependencies correctly. In this instance, the kernel failed to enforce strict upper bounds on the counts for these reference picture sets before passing them to decoder drivers. This oversight allows a malicious or malformed media stream to specify RPS counts that exceed the maximum limits defined by the HEVC specification, which are capped at sixty-four short-term reference picture sets and thirty-two long-term references.
This lack of validation creates a direct path for out-of-bounds memory access within kernel space. When decoder drivers receive these unchecked values, they attempt to iterate over or index into dynamic arrays allocated based on these counts. If the specified counts exceed the actual size of the internal data structures or the logical limits imposed by the standard, the driver may read from or write to memory locations outside the intended buffer boundaries. This scenario is a classic example of improper input validation leading to potential buffer overflow conditions. The vulnerability effectively allows an attacker who can supply crafted media streams to trigger invalid memory operations within the kernel context, potentially leading to system instability, denial of service through kernel panic, or in more complex exploitation scenarios, arbitrary code execution with elevated privileges.
The operational impact of this flaw is significant for systems processing untrusted video content, such as set-top boxes, mobile devices, and servers handling media transcoding services. An attacker could exploit this vulnerability by providing a specially crafted HEVC stream that triggers the out-of-bounds access during the initialization or decoding phase. This could result in the corruption of kernel memory structures, leading to crashes or data leakage. Furthermore, because V4L2 controls are often exposed through device interfaces accessible by user-space applications, the attack surface is relatively broad for any application interacting with video capture or output devices without proper sandboxing or privilege separation.
To mitigate this vulnerability, it is essential that all input values related to HEVC SPS parameters be rigorously validated against the constraints defined in the ITU-T H.265 standard before being passed to lower-level driver components. The fix involves adding explicit checks within the v4l2-ctrls module to reject any SPS configuration where short-term RPS counts exceed sixty-four or long-term reference picture counts exceed thirty-two. Additionally, validation must extend to Extended SPS entries, ensuring that both positive and negative picture count deltas do not surpass sixteen-entry array limits and that combined delta-Picture Order Count values remain within the maximum Decoded Picture Buffer size allowed by the standard. System administrators should ensure their kernels are updated with patches addressing this specific media subsystem flaw. Developers integrating HEVC decoding capabilities must also implement defensive programming practices, verifying all external inputs against specification-defined bounds to prevent similar out-of-bounds access issues in future implementations. This vulnerability aligns with CWE-20 Improper Input Validation and can be categorized under ATT&CK techniques related to exploitation of input validation flaws for privilege escalation or denial of service.