CVE-2026-68206: media: v4l2-ctrls: validate HEVC active reference counts
In the Linux kernel, the following vulnerability has been resolved:
media: v4l2-ctrls: validate HEVC active reference counts
HEVC slice parameters are shared stateless V4L2 controls, but the common validation path does not verify the active L0/L1 reference counts before driver-specific code consumes them.
The original report came from Cedrus, but the active count bounds are not Cedrus-specific. Validate them in the common HEVC slice control path so stateless HEVC drivers get the same basic guarantees as soon as the control is queued.
Do not reject refidxl0/refidxl1 entries here. Existing userspace may use out-of-range sentinel values such as 0xff for missing references, and some hardware can use that information for concealment. Keep this common check limited to the active reference counts.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-68206?
CVE-2026-68206 has a risk score of 27, indicating a significant vulnerability.
How do I fix CVE-2026-68206?
To fix CVE-2026-68206, update the Linux kernel to the latest version where this vulnerability has been resolved.
What systems are affected by CVE-2026-68206?
CVE-2026-68206 affects systems running vulnerable versions of the Linux kernel that utilize HEVC slice parameters.
What does CVE-2026-68206 affect in the Linux kernel?
CVE-2026-68206 affects the validation of HEVC active reference counts in the media subsystem of the Linux kernel.
Is there a workaround for CVE-2026-68206 while waiting for a patch?
Currently, there is no known workaround for CVE-2026-68206; the best action is to apply the kernel update as soon as it becomes available.