Linux Kernel up to 7.2.4 rkvdec st_ref_pic_set_prediction out-of-bounds

Summaryinfo

A vulnerability was found in Linux Kernel up to 7.2.4. It has been declared as problematic. Affected is the function st_ref_pic_set_prediction of the component rkvdec. Executing a manipulation can lead to out-of-bounds. This vulnerability is tracked as CVE-2026-89882. The attack is restricted to local execution. No exploit exists. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic was found in Linux Kernel up to 7.2.4. This vulnerability affects the function st_ref_pic_set_prediction of the component rkvdec. The manipulation with an unknown input leads to a out-of-bounds vulnerability. The CWE definition for the vulnerability is CWE-125. The product reads data past the end, or before the beginning, of the intended buffer. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

In the Linux kernel, the following vulnerability has been resolved: media: rkvdec: hevc: guard INTER_REF_PIC_SET_PRED index underflow st_ref_pic_set_prediction() computes the reference RPS index as st_rps_idx - (delta_idx_minus1 + 1) per HEVC spec equation 7-59. Both operands are u8, so when delta_idx_minus1 + 1 exceeds the current index the subtraction wraps and the subsequent array access at calculated_rps_st_sets[ref_rps_idx] reads far out of bounds. A userspace V4L2 client that can open the RKVDEC m2m decoder can submit an EXT_SPS_ST_RPS control with INTER_REF_PIC_SET_PRED set and delta_idx_minus1 crafted to trigger the underflow. Reject the entry early when the reference index would underflow.

The advisory is shared for download at git.kernel.org. This vulnerability was named CVE-2026-89882 since 09/11/2026. The exploitation appears to be easy. The attack needs to be approached locally. There are known technical details, but no exploit is available.

Upgrading to version 7.2.5 or 7.3-rc1 eliminates this vulnerability. Applying the patch 74938f83a8abbee8f502dfb5d94213b2497d1edf/052c5ed5a1d96a6b24fd50ccda16fc6841ee7ca3 is able to eliminate this problem. The best possible mitigation is suggested to be upgrading to the latest version.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 7.2.0
• 7.2.1
• 7.2.2
• 7.2.3
• 7.2.4

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion