CVE-2026-68229: media: cedrus: skip invalid H.264 reference list entries
In the Linux kernel, the following vulnerability has been resolved:
media: cedrus: skip invalid H.264 reference list entries
Cedrus consumes H.264 refpiclist0/refpiclist1 entries from the stateless slice control and later uses their indices to look up decode->dpb[] in cedruswritereflist().
Rejecting such controls in cedrustryctrl() would break existing userspace, since stateless H.264 reference lists may legitimately carry out-of-range indices for missing references. Instead, guard the actual DPB lookup in Cedrus and skip entries whose indices do not fit the fixed V4L2H264NUMDPBENTRIES array.
This keeps the fix local to the driver use site and avoids out-of-bounds reads from malformed or unsupported reference list entries.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-68229?
CVE-2026-68229 has a risk score of 23, indicating a significant security impact.
How do I fix CVE-2026-68229?
To fix CVE-2026-68229, update your Linux kernel to the latest patched version that resolves this vulnerability.
What systems are affected by CVE-2026-68229?
CVE-2026-68229 affects systems running vulnerable versions of the Linux kernel using CedarView hardware.
What type of vulnerability is CVE-2026-68229?
CVE-2026-68229 is a media processing vulnerability related to the handling of H.264 reference list entries in the Linux kernel.
Can CVE-2026-68229 be exploited remotely?
Exploitation of CVE-2026-68229 requires local access to the affected system, making remote exploitation unlikely.