CVE-2026-89873

CVE-2026-89873 is an input-validation flaw in the Linux kernel's Video for Linux 2 (V4L2) control framework affecting HEVC decode controls. The HEVC SPS control carries short-term and long-term reference picture set (RPS) counts that decoder drivers use to walk matching EXT SPS dynamic arrays, but the kernel did not reject counts exceeding HEVC limits (64 short-term sets, 32 long-term references, 16-entry positive/negative picture count arrays, and the HEVC DPB maximum) before drivers consumed them. A local attacker with low privileges who can submit crafted HEVC controls through a V4L2 video device node can trigger drivers to index beyond the control arrays, causing kernel out-of-bounds access with high impact to confidentiality, integrity and availability (CVSS 7.8). Any Linux system running kernels whose media subsystem includes the unvalidated HEVC control handling is potentially affected, most practically embedded/ARM boards with HEVC stateless decoder drivers; specific affected and fixed version numbers are not stated in the available data. No public proof-of-concept, in-the-wild exploitation, or KEV listing is known.

What to do: Apply a stable kernel update that includes the commit 'media: v4l2-ctrls: validate HEVC EXT SPS RPS counts' as soon as your vendor ships it. Until patched, restrict write access to V4L2 video device nodes (/dev/video*) to trusted users/groups and treat untrusted local accounts on HEVC-decode-capable boards as elevated risk. Verify whether your systems actually use HEVC stateless decoder drivers to prioritize patching.