CVE-2026-89882 (GCVE-0-2026-89882)

Vulnerability from cvelistv5 – Published: 2026-09-16 10:31 – Updated: 2026-09-16 14:39
VLAI
Title
media: rkvdec: hevc: guard INTER_REF_PIC_SET_PRED index underflow
Summary
In the Linux kernel, the following vulnerability has been resolved: media: rkvdec: hevc: guard INTER_REF_PIC_SET_PRED index underflow st_ref_pic_set_prediction() computes the reference RPS index as st_rps_idx - (delta_idx_minus1 + 1) per HEVC spec equation 7-59. Both operands are u8, so when delta_idx_minus1 + 1 exceeds the current index the subtraction wraps and the subsequent array access at calculated_rps_st_sets[ref_rps_idx] reads far out of bounds. A userspace V4L2 client that can open the RKVDEC m2m decoder can submit an EXT_SPS_ST_RPS control with INTER_REF_PIC_SET_PRED set and delta_idx_minus1 crafted to trigger the underflow. Reject the entry early when the reference index would underflow.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: c9a59dc2acc72789d5c778af080d1e65af84862c , < 74938f83a8abbee8f502dfb5d94213b2497d1edf (git)
Affected: c9a59dc2acc72789d5c778af080d1e65af84862c , < 052c5ed5a1d96a6b24fd50ccda16fc6841ee7ca3 (git)
guessed Create a notification for this product.
Linux Linux Affected: 7.0
Unaffected: 0 , < 7.0 (semver)
Unaffected: 7.2.5 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/media/platform/rockchip/rkvdec/rkvdec-hevc-common.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "74938f83a8abbee8f502dfb5d94213b2497d1edf",
              "status": "affected",
              "version": "c9a59dc2acc72789d5c778af080d1e65af84862c",
              "versionType": "git"
            },
            {
              "lessThan": "052c5ed5a1d96a6b24fd50ccda16fc6841ee7ca3",
              "status": "affected",
              "version": "c9a59dc2acc72789d5c778af080d1e65af84862c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/media/platform/rockchip/rkvdec/rkvdec-hevc-common.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "7.0"
            },
            {
              "lessThan": "7.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.5",
                  "versionStartIncluding": "7.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "7.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: rkvdec: hevc: guard INTER_REF_PIC_SET_PRED index underflow\n\nst_ref_pic_set_prediction() computes the reference RPS index as\nst_rps_idx - (delta_idx_minus1 + 1) per HEVC spec equation 7-59.\nBoth operands are u8, so when delta_idx_minus1 + 1 exceeds the\ncurrent index the subtraction wraps and the subsequent array access\nat calculated_rps_st_sets[ref_rps_idx] reads far out of bounds.\n\nA userspace V4L2 client that can open the RKVDEC m2m decoder can\nsubmit an EXT_SPS_ST_RPS control with INTER_REF_PIC_SET_PRED set\nand delta_idx_minus1 crafted to trigger the underflow.\n\nReject the entry early when the reference index would underflow."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The EXT_SPS_ST_RPS control is applied only via VIDIOC_S_EXT_CTRLS or a media request on the local rkvdec V4L2 m2m node (/dev/videoN), then consumed in rkvdec_hevc_run after QBUF/STREAMON. The HEVC RPS parser is not reachable from the network stack.\nAC:L - The attacker sets INTER_REF_PIC_SET_PRED and a delta_idx_minus1 that makes the u8 index wrap (e.g. idx=0 and delta_idx_minus1=0 yields ref_rps_idx=255). v4l2-ctrls never validates delta_idx_minus1 and try_ctrl only checks SPS, so the out-of-bounds access is deterministic with no race.\nPR:L - rkvdec_open and the ioctl path perform no capability check. An unprivileged local account that can open the decoder node is sufficient, typically via the video group or the Android/embedded media codec service that sandboxed apps can reach.\nUI:N - The attacking process itself opens the decoder, attaches a crafted EXT_SPS_ST_RPS control, queues buffers, and starts streaming. No separate victim action is required.\nS:U - The underflow corrupts kernel heap, stack, and the driver\u0027s DMA RPS table inside the same kernel security authority. This is local privilege escalation, not a VM escape, IOMMU bypass, or sandbox-boundary crossing.\nC:H - A wrapped u8 ref_rps_idx indexes calculated_rps_st_sets tens of kilobytes past the kzalloc allocation (up to 255 * sizeof(struct calculated_rps_st_set)). Those out-of-bounds bytes become loop bounds and are copied into the hardware RPS table, giving an attacker-steerable kernel memory read.\nI:H - Out-of-bounds num_delta_pocs overflows the 16-byte stack arrays use_delta_flag and used_by_curr_pic_flag, later loops write past st_rps-\u003edelta_poc_s0[16] on the heap, and assemble_hw_st_rps bit-writes rps-\u003einfo with an unbounded index. That is an attacker-influenced kernel write usable for control-flow hijack.\nA:H - The far out-of-bounds pointer, stack smash, and DMA RPS-table overrun each cause a kernel oops, KASAN report, or wedged decoder, and the attacker can repeat the sequence at will."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-16T14:39:33.170Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/74938f83a8abbee8f502dfb5d94213b2497d1edf"
        },
        {
          "url": "https://git.kernel.org/stable/c/052c5ed5a1d96a6b24fd50ccda16fc6841ee7ca3"
        }
      ],
      "title": "media: rkvdec: hevc: guard INTER_REF_PIC_SET_PRED index underflow",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89882",
    "datePublished": "2026-09-16T10:31:47.644Z",
    "dateReserved": "2026-09-11T19:38:34.772Z",
    "dateUpdated": "2026-09-16T14:39:33.170Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-89882",
      "date": "2026-09-25",
      "epss": "0.00165",
      "percentile": "0.05061"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/media/platform/rockchip/rkvdec/rkvdec-hevc-common.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "74938f83a8abbee8f502dfb5d94213b2497d1edf",
                    "status": "affected",
                    "version": "c9a59dc2acc72789d5c778af080d1e65af84862c",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "052c5ed5a1d96a6b24fd50ccda16fc6841ee7ca3",
                    "status": "affected",
                    "version": "c9a59dc2acc72789d5c778af080d1e65af84862c",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/media/platform/rockchip/rkvdec/rkvdec-hevc-common.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "7.0"
                  },
                  {
                    "lessThan": "7.0",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.5",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3-rc1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: rkvdec: hevc: guard INTER_REF_PIC_SET_PRED index underflow\n\nst_ref_pic_set_prediction() computes the reference RPS index as\nst_rps_idx - (delta_idx_minus1 + 1) per HEVC spec equation 7-59.\nBoth operands are u8, so when delta_idx_minus1 + 1 exceeds the\ncurrent index the subtraction wraps and the subsequent array access\nat calculated_rps_st_sets[ref_rps_idx] reads far out of bounds.\n\nA userspace V4L2 client that can open the RKVDEC m2m decoder can\nsubmit an EXT_SPS_ST_RPS control with INTER_REF_PIC_SET_PRED set\nand delta_idx_minus1 crafted to trigger the underflow.\n\nReject the entry early when the reference index would underflow."
          }
        ],
        "id": "CVE-2026-89882",
        "lastModified": "2026-09-16T15:18:14.850",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-16T11:16:56.647",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/052c5ed5a1d96a6b24fd50ccda16fc6841ee7ca3"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/74938f83a8abbee8f502dfb5d94213b2497d1edf"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-19T01:43:38Z",
      "cve": "CVE-2026-89882",
      "id": "CVE-2026-89882",
      "initial_release_date": "2026-09-17T16:36:08Z",
      "product_status:known_not_affected": "347",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-89882",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-89882.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.