Executive brief
The Linux kernel's video-for-linux 2 (V4L2) control validation subsystem failed to properly validate bounds on HEVC video codec parameters, allowing crafted control values to bypass array size checks. This could enable local attackers to cause denial of service or potentially corrupt kernel memory when HEVC video decoding is used.
Technical details
The vulnerability is an input validation weakness in the v4l2-ctrls-core.c v4l2_ctrl validation function, specifically in the HEVC SPS (Sequence Parameter Set) control handling. The vulnerable code failed to validate that the num_short_term_ref_pic_sets and num_long_term_ref_pics_sps counts remained within HEVC specification limits (64 and 32 respectively), nor did it validate that EXT SPS ST RPS (short-term reference picture set) negative/positive picture counts stayed within 16-entry array bounds. Attackers with local access to set V4L2 controls (typically via /dev/video* devices) could supply out-of-bounds counts, causing decoder drivers to perform unbounded array indexing. The fix adds explicit validation checks that reject SPS values exceeding specification limits before they reach decoder drivers.
Affected products
- Linux Linux kernel affected versions include but not limited to linux-5.x through linux-7.x series
Timeline
- 2026-09-16: disclosed: Published via NVD
- 2026-07-17: patched: Fix committed upstream by Hans Verkuil
- 2026-09-11: patched: Backported to stable kernel trees