CVE-2026-98882 in Linux
Summary
by MITRE • 10/23/2026
In the Linux kernel, the following vulnerability has been resolved:
media: chips-media: wave5: Add range checks for dec_output_info
If the driver's dec_output_info contains invalid data the driver can write in invalid memory. Add a range check for that.
This fixes this smatch error: drivers/media/platform/chips-media/wave5/wave5-vpuapi.c:588 wave5_vpu_dec_get_output_info() error: buffer overflow 'inst->frame_buf' 64 <= 127
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/23/2026
The vulnerability identified in the Linux kernel media subsystem, specifically within the chips-media wave5 video processing unit driver, represents a critical memory safety flaw arising from insufficient input validation. The core issue resides in the function responsible for retrieving decoding output information, where the application interface fails to verify that indices or offsets provided by user space are within acceptable bounds before being used as array subscripts or pointer arithmetic operands. This lack of boundary checking allows an attacker who can interact with the media device node to supply crafted data structures containing out-of-range values. When these invalid parameters are processed, the driver proceeds to access memory locations that lie outside the allocated buffer for frame buffers, leading directly to a heap-based buffer overflow condition as flagged by static analysis tools like smatch which detected potential writes beyond the sixty-fourth element of an array with a maximum index limit of one hundred and twenty-seven.
From a technical perspective, this flaw is classified under CWE-120 Buffer Copy without Checking Size of Input Classic Buffer Overflow or more specifically CWE-787 Out-of-bounds Write when considering the write operation itself rather than just the read access. The vulnerability exploits the trust placed in user-supplied data within kernel space drivers, a common attack vector for local privilege escalation. By manipulating the dec_output_info structure, an attacker can force the kernel to perform memory writes at arbitrary addresses relative to the frame buffer allocation. This capability undermines the integrity of kernel memory and can potentially be leveraged to overwrite critical function pointers or control structures, thereby achieving arbitrary code execution with root privileges. The specific error message indicating a range between sixty-four and one hundred twenty-seven suggests that while some bounds might exist elsewhere in the logic, this particular path lacks explicit validation for higher index values, creating an exploitable gap in the security boundary of the driver.
The operational impact of this vulnerability is severe due to its potential for local privilege escalation on affected systems running vulnerable versions of the Linux kernel with the wave5 VPU driver enabled. An unprivileged user or a compromised application can exploit this flaw to crash the system, causing a denial of service through kernel panic, or more dangerously, to gain full control over the host machine. In environments where media processing is exposed via network services or shared computing resources, such as cloud instances providing video transcoding capabilities, this vulnerability could be triggered remotely if combined with other flaws that allow remote code execution leading up to local exploitation of this memory corruption issue. The presence of such a flaw in kernel-space drivers significantly expands the attack surface for adversaries seeking persistent access or lateral movement within compromised networks.
Mitigation strategies primarily involve applying the upstream Linux kernel patches that introduce rigorous range checks before any array indexing operations occur. Developers and system administrators should ensure that all systems utilizing the chips-media wave5 driver are updated to a version where this validation logic has been implemented. In addition to patching, defense-in-depth measures such as enabling Kernel Self-Protection features like KASLR can help mitigate exploitation by randomizing memory layouts, making it harder for attackers to predict target addresses. Furthermore, enforcing strict access controls on media device nodes and limiting the capabilities of processes that interact with video decoding hardware reduces the likelihood of successful exploitation. Continuous monitoring using static analysis tools during development cycles is also recommended to catch similar input validation oversights before they reach production environments.