CVE-2026-89724: media: vicodec: fix out-of-bounds write in FWHT encoder
In the Linux kernel, the following vulnerability has been resolved:
media: vicodec: fix out-of-bounds write in FWHT encoder
vidiocsfmtvidout() sizes the encoder CAPTURE buffer from the compressed descriptor pixfmtfwht, whose sizeimagemult is 3: codedw codedh 3 + sizeof(struct fwhtcframehdr). fwhtencodeframe() encodes one plane per component, and an incompressible plane takes the FWHTFRAMEUNENCODED path in encodeplane(), copying the plane verbatim.
For a 4-component pixel format all four planes are full resolution (widthdiv == heightdiv == 1), so a frame that forces every plane through the unencoded fallback writes sizeof(struct fwhtcframehdr) + 4 codedw codedh bytes, overrunning the plane by codedw codedh, which can result in corruption of adjacent kernel heap memory.
Bump pixfmtfwht.sizeimagemult from 3 to 4, matching the largest componentsnum among the supported raw formats, so the capture buffer is always large enough for the unencoded fallback.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
vicodec FWHT encoderto a version that resolves this vulnerability.Patch fix out-of-bounds write in FWHT encoder
Event History
Frequently Asked Questions
What input conditions are needed to reach the out-of-bounds write?
The encoder must process a four-component pixel format in which all four planes are full resolution. Each plane must take the unencoded fallback path, causing four full-resolution planes to be copied into a capture buffer sized for only three.
How can I determine whether the fix is present?
Check whether the FWHT compressed-format sizeimage multiplier is 4 rather than 3. The fix increases pixfmt_fwht.sizeimage_mult to 4 so the capture buffer can hold the header plus four full-resolution unencoded planes.
What is the available remediation?
Apply the kernel change that increases the FWHT capture-buffer sizing multiplier from 3 to 4. This prevents the unencoded fallback for supported four-component raw formats from writing past the allocated capture buffer.