CVE-2026-89873: media: v4l2-ctrls: validate HEVC EXT SPS RPS counts
In the Linux kernel, the following vulnerability has been resolved:
media: v4l2-ctrls: validate HEVC EXT SPS RPS counts
The HEVC SPS control carries the short-term and long-term RPS counts that decoder drivers use to walk the matching EXT SPS dynamic arrays. Reject SPS values that exceed the HEVC limits of 64 short-term sets and 32 long-term references so drivers cannot later index beyond those controls.
Also reject EXT SPS ST RPS entries whose negative or positive picture counts exceed the 16-entry arrays, or whose combined delta-POC count exceeds the HEVC DPB maximum.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Update the Linux kernel media/v4l2-ctrls logic to reject HEVC EXT SPS values that exceed the HEVC limit of 64 short-term sets, since EXT SPS dynamic arrays are indexed by decoder drivers.
Linux kernel (media/v4l2-ctrls: validate HEVC EXT SPS RPS counts) Reject HEVC EXT SPS values that exceed HEVC limits (64 short-term sets) = Implement check: SPS values must not exceed the HEVC limits of 64 short-term sets - Configuration
Update the Linux kernel media/v4l2-ctrls logic to reject EXT SPS ST RPS entries whose counts exceed the 16-entry arrays, or whose combined delta-POC count exceeds the HEVC DPB maximum, and also reject EXT SPS ST RPS entries based on invalid negative/positive picture constraints as described.
Linux kernel (media/v4l2-ctrls: validate HEVC EXT SPS RPS counts) Reject EXT SPS ST RPS entries when counts exceed arrays / combined delta-POC exceeds DPB maximum = Implement check: counts exceed 16-entry arrays OR combined delta-POC count exceeds HEVC DPB maximum
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems using Linux kernel V4L2 HEVC decoder controls are exposed when decoder drivers consume SPS and EXT SPS control data. The issue concerns drivers that walk the associated dynamic arrays using the supplied RPS counts.
What input is required to trigger the unsafe behavior?
An attacker would need to supply HEVC SPS or EXT SPS control values with RPS counts beyond the supported limits. Relevant invalid values include more than 64 short-term sets, more than 32 long-term references, per-entry negative or positive picture counts over 16, or a combined delta-POC count above the HEVC DPB maximum.
What does the fix change?
The fix rejects invalid SPS and EXT SPS RPS count values before decoder drivers use them to index matching control arrays. This prevents later out-of-bounds array access based on oversized counts.