Look up another CVE · open CVE-2026-89882 in the interactive tracker
CVE-2026-89882
media: rkvdec: hevc: guard INTER_REF_PIC_SET_PRED index underflow
Published 2026-09-16 (33 days ago) by the Linux kernel CNA. Subsystem drivers/media. Debian urgency: unimportant.
What to do, per Debian release
Debian's own status for CVE-2026-89882 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | not affected | 6.1.190-1 | Nothing to do. bookworm never shipped the vulnerable code. |
| Debian 13trixie | not affected | 6.12.113-1 | Nothing to do. trixie never shipped the vulnerable code. |
| Debian 14forky | fixed | 7.2.6-1 | Update the kernel and reboot. Fixed in 7.2.6-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.2.6-1 | Update the kernel and reboot. Fixed in 7.2.6-1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
st_ref_pic_set_prediction() computes the reference RPS index as st_rps_idx - (delta_idx_minus1 + 1) per HEVC spec equation 7-59. Both operands are u8, so when delta_idx_minus1 + 1 exceeds the current index the subtraction wraps and the subsequent array access at calculated_rps_st_sets[ref_rps_idx] reads far out of bounds. A userspace V4L2 client that can open the RKVDEC m2m decoder can submit an EXT_SPS_ST_RPS control with INTER_REF_PIC_SET_PRED set and delta_idx_minus1 crafted to trigger the underflow. Reject the entry early when the reference index would underflow.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
drivers/media/platform/rockchip/rkvdec/rkvdec-hevc-common.c
- What this is
- ROCKCHIP RKVDEC VIDEO DECODER DRIVERMAINTAINERS section matched on drivers/media/platform/rockchip/rkvdec/ · linux-media@vger.kernel.org · Maintained
- Kernel module
- rockchip_vdec
Check it on the machine
grep -w CONFIG_VIDEO_ROCKCHIP_VDEC /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
lsmod | grep -w rockchip_vdecPrints a line if that module is loaded right now, and nothing if it is not. One that is not loaded can still be loaded later by anything that needs it.
Show whether Debian builds this, per release
Debian builds this, but not on every flavour. At least one release below builds the code on some of its kernel flavours and not on others, so the answer depends on the architecture and flavour installed. The build rule could not be established for 2 releases, so nothing is claimed about those.
- bookworm, trixie?
- forky, sidMnot built on amd64/amd64, amd64/cloud-amd64, amd64/rt-amd64, arm64/cloud-arm64, loong64/loong64, ppc64el/powerpc64le, ppc64el/powerpc64le-64k, riscv64/riscv64, s390x/s390x
- ?
- not established - no Makefile entry for the affected file
- M
- a module where it is built at all; some flavours do not build it
Where a release above reads "not established", no build rule for the affected file was found in that release's kernel tree. That is a gap in this lookup, not a finding that the code is absent.
- Build switch
- CONFIG_VIDEO_ROCKCHIP_VDEC
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-09-16 (33 days ago)source
- CVSS
- 7.8 high
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- local (AV:L)source
- EPSS
- 0.17%, higher than 5.4% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- unimportantsource
- Subsystem
- drivers/media
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 7.0 | 7.2.5 | 74938f83a8ab |
| 7.0 | 7.3 | 052c5ed5a1d9 |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:LAttack vector, local
- The EXT_SPS_ST_RPS control is applied only via VIDIOC_S_EXT_CTRLS or a media request on the local rkvdec V4L2 m2m node (/dev/videoN), then consumed in rkvdec_hevc_run after QBUF/STREAMON. The HEVC RPS parser is not reachable from the network stack.
- AC:LAttack complexity, low
- The attacker sets INTER_REF_PIC_SET_PRED and a delta_idx_minus1 that makes the u8 index wrap (e.g. idx=0 and delta_idx_minus1=0 yields ref_rps_idx=255). v4l2-ctrls never validates delta_idx_minus1 and try_ctrl only checks SPS, so the out-of-bounds access is deterministic with no race.
- PR:LPrivileges required, low
- rkvdec_open and the ioctl path perform no capability check. An unprivileged local account that can open the decoder node is sufficient, typically via the video group or the Android/embedded media codec service that sandboxed apps can reach.
- UI:NUser interaction, none
- The attacking process itself opens the decoder, attaches a crafted EXT_SPS_ST_RPS control, queues buffers, and starts streaming. No separate victim action is required.
- S:UScope, unchanged
- The underflow corrupts kernel heap, stack, and the driver's DMA RPS table inside the same kernel security authority. This is local privilege escalation, not a VM escape, IOMMU bypass, or sandbox-boundary crossing.
- C:HConfidentiality impact, high
- A wrapped u8 ref_rps_idx indexes calculated_rps_st_sets tens of kilobytes past the kzalloc allocation (up to 255 * sizeof(struct calculated_rps_st_set)). Those out-of-bounds bytes become loop bounds and are copied into the hardware RPS table, giving an attacker-steerable kernel memory read.
- I:HIntegrity impact, high
- Out-of-bounds num_delta_pocs overflows the 16-byte stack arrays use_delta_flag and used_by_curr_pic_flag, later loops write past st_rps->delta_poc_s0[16] on the heap, and assemble_hw_st_rps bit-writes rps->info with an unbounded index. That is an attacker-influenced kernel write usable for control-flow hijack.
- A:HAvailability impact, high
- The far out-of-bounds pointer, stack smash, and DMA RPS-table overrun each cause a kernel oops, KASAN report, or wedged decoder, and the attacker can repeat the sequence at will.