CVE-2026-98882: media: chips-media: wave5: Add range checks for dec_output_info

Q: What component is affected?

The affected component is the Linux kernel's chips-media wave5 media driver, specifically its handling of decoder output information in wave5_vpu_dec_get_output_info().

Q: What condition triggers the memory-safety issue?

The issue occurs when dec_output_info contains invalid data. Without range validation, the driver can index or write beyond the inst->frame_buf bounds, which the reported diagnostic identifies as a possible overflow between 64 and 127 entries.

Published Oct 23, 2026

Updated

In the Linux kernel, the following vulnerability has been resolved:

media: chips-media: wave5: Add range checks for decoutputinfo

If the driver's decoutputinfo contains invalid data the driver can write in invalid memory. Add a range check for that.

This fixes this smatch error: drivers/media/platform/chips-media/wave5/wave5-vpuapi.c:588 wave5vpudecgetoutputinfo() error: buffer overflow 'inst->framebuf' 64 <= 127

Affected Software

1 affected component

Linux Linux kernel

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Configuration
Add range checks for dec_output_info to reject invalid data before it can cause writes to invalid memory.
Linux kernel chips-media wave5 VPU driver dec_output_info range checks = enabled

Event History

Oct 23, 2026

CVE Published

via MITRE·11:37 AM

Data Sourced

via MITRE·11:37 AM

Description

Frequently Asked Questions

What component is affected?

The affected component is the Linux kernel's chips-media wave5 media driver, specifically its handling of decoder output information in wave5_vpu_dec_get_output_info().

What condition triggers the memory-safety issue?

The issue occurs when dec_output_info contains invalid data. Without range validation, the driver can index or write beyond the inst->frame_buf bounds, which the reported diagnostic identifies as a possible overflow between 64 and 127 entries.

Is a fix available?

Yes. The issue is resolved by adding range checks for dec_output_info, and three stable-kernel commit references are provided for the fix.

CVE-2026-98882: media: chips-media: wave5: Add range checks for dec_output_info

Affected Software

Remediation

Event History

Frequently Asked Questions

What component is affected?

What condition triggers the memory-safety issue?

Is a fix available?

Company

Resources

Contact

Frequently Asked Questions

What component is affected?

What condition triggers the memory-safety issue?

Is a fix available?