CVE-2026-89873: media: v4l2-ctrls: validate HEVC EXT SPS RPS counts
In the Linux kernel, the following vulnerability has been resolved:
media: v4l2-ctrls: validate HEVC EXT SPS RPS counts
The HEVC SPS control carries the short-term and long-term RPS counts that decoder drivers use to walk the matching EXT SPS dynamic arrays. Reject SPS values that exceed the HEVC limits of 64 short-term sets and 32 long-term references so drivers cannot later index beyond those controls.
Also reject EXT SPS ST RPS entries whose negative or positive picture counts exceed the 16-entry arrays, or whose combined delta-POC count exceeds the HEVC DPB maximum.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
Validate HEVC SPS and EXT SPS RPS counts: reject values exceeding 64 short-term sets or 32 long-term references, reject negative or positive picture counts exceeding the 16-entry arrays, and reject combined delta-POC counts exceeding the HEVC DPB maximum.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems using Linux kernel V4L2 HEVC decoder controls are exposed when decoder drivers consume SPS and EXT SPS control data. The issue concerns drivers that walk the associated dynamic arrays using the supplied RPS counts.
What input is required to trigger the unsafe behavior?
An attacker would need to supply HEVC SPS or EXT SPS control values with RPS counts beyond the supported limits. Relevant invalid values include more than 64 short-term sets, more than 32 long-term references, per-entry negative or positive picture counts over 16, or a combined delta-POC count above the HEVC DPB maximum.
What does the fix change?
The fix rejects invalid SPS and EXT SPS RPS count values before decoder drivers use them to index matching control arrays. This prevents later out-of-bounds array access based on oversized counts.