{"id":"CVE-2026-89873","published":"2026-09-16T11:16:55.540","lastModified":"2026-09-16T15:18:14.330","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: v4l2-ctrls: validate HEVC EXT SPS RPS counts\n\nThe HEVC SPS control carries the short-term and long-term RPS counts\nthat decoder drivers use to walk the matching EXT SPS dynamic arrays.\nReject SPS values that exceed the HEVC limits of 64 short-term sets and\n32 long-term references so drivers cannot later index beyond those\ncontrols.\n\nAlso reject EXT SPS ST RPS entries whose negative or positive picture\ncounts exceed the 16-entry arrays, or whose combined delta-POC count\nexceeds the HEVC DPB maximum.","cvssScore":7.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":[],"vendors":[],"products":[],"references":[{"url":"https://git.kernel.org/stable/c/30f85a7c59113a8844b276efc010085a34f912e9","tags":[]},{"url":"https://git.kernel.org/stable/c/796b5c6d4f1615d59d5d8fe5a38fae6bfdfe878e","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"This vulnerability allows for potential buffer overflow issues in the Linux kernel's handling of HEVC SPS controls, which could lead to denial of service or potentially more severe consequences if exploited.","exploitability":"Exploitation requires specific conditions, such as the presence of malformed HEVC SPS data, making it moderately difficult. Precondition is the availability of the vulnerable kernel version.","blast_radius":"If exploited, the impact could range from denial of service to potential kernel crashes or other severe consequences, depending on the system's configuration and the nature of the exploit.","remediation":"Upgrade to the specific version 6.1.11-rc1 or later.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["dos","kernel","hevc","v4l2"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-10-08T08:43:16.991Z"}}