Executive brief
The Linux kernel's RKVDEC video decoder supports hardware-accelerated HEVC video playback, commonly used in multimedia and video streaming applications. An integer underflow vulnerability in the reference picture set prediction logic allows an unprivileged user with access to the decoder to trigger out-of-bounds memory reads, potentially exposing sensitive kernel data or causing a denial of service.
Technical details
The vulnerability exists in the st_ref_pic_set_prediction() function in the RKVDEC HEVC decoder driver (drivers/media/platform/rockchip/rkvdec/rkvdec-hevc-common.c). When processing HEVC reference picture sets, the code computes ref_rps_idx = st_rps_idx - (delta_idx_minus1 + 1) using 8-bit unsigned integers. If delta_idx_minus1 + 1 exceeds st_rps_idx, the subtraction wraps around, causing an attacker-controlled out-of-bounds array index. A local userspace V4L2 client can submit a malicious EXT_SPS_ST_RPS control with crafted delta_idx_minus1 to trigger the underflow. The fix adds an early return check rejecting cases where the reference index would underflow.
Affected products
- Linux Linux kernel versions prior to fix commit 052c5ed5a1d96a6b24fd50ccda16fc6841ee7ca3
Timeline
- 2026-09-16: disclosed: CVE-2026-89882 published
- 2026-07-17: patched: Patch merged upstream via commit 052c5ed5a1d96a6b24fd50ccda16fc6841ee7ca3
- 2026-09-11: patched: Backported to stable kernel branches via commit 74938f83a8abbee8f502dfb5d94213b2497d1edf