CVE-2026-89882

The Linux kernel's RKVDEC (Rockchip video decoder) HEVC stateless driver contains an index underflow in st_ref_pic_set_prediction(), which computes the reference RPS index as st_rps_idx - (delta_idx_minus1 + 1) per HEVC equation 7-59; because both operands are u8, a crafted delta_idx_minus1 makes the unsigned subtraction wrap and the subsequent read of calculated_rps_st_sets[ref_rps_idx] goes far out of bounds. A local user (low privileges, per CVSS AV:L/PR:L) who can open the RKVDEC memory-to-memory V4L2 decoder can trigger this by submitting an EXT_SPS_ST_RPS control with INTER_REF_PIC_SET_PRED set and a crafted delta_idx_minus1. The result is a kernel-space out-of-bounds read, which the CVSS vector rates as high impact to confidentiality, integrity, and availability, i.e., potential kernel memory disclosure or a crash of the media pipeline. Affected systems are Rockchip-based devices (SBCs, TV boxes/sticks, embedded boards) running kernels that include the RKVDEC HEVC driver. No public proof-of-concept or known exploitation exists, and the issue is not in CISA KEV; the upstream fix rejects the entry early when the reference index would underflow.

What to do: Update Rockchip-based devices to a kernel containing the upstream fix ('media: rkvdec: hevc: guard INTER_REF_PIC_SET_PRED index underflow') once backports are available, since no fixed version number is provided in the data. Until then, restrict access to the RKVDEC V4L2 device nodes (e.g., /dev/video*) to trusted users/groups, avoid exposing /dev/video to unprivileged users or containers, and check whether the rkvdec module is loaded on Rockchip hardware.