CVE-2026-89724

In the Linux kernel, the following vulnerability has been resolved:

media: vicodec: fix out-of-bounds write in FWHT encoder

vidioc s fmt vid out() sizes the encoder CAPTURE buffer from the compressed descriptor pixfmt fwht, whose sizeimage mult is 3: coded w * coded h * 3 + sizeof(struct fwht cframe hdr). fwht encode frame() encodes one plane per component, and an incompressible plane takes the FWHT FRAME UNENCODED path in encode plane(), copying the plane verbatim.

For a 4-component pixel format all four planes are full resolution (width div == height div == 1), so a frame that forces every plane through the unencoded fallback writes sizeof(struct fwht cframe hdr) + 4 * coded w * coded h bytes, overrunning the plane by coded w * coded h, which can result in corruption of adjacent kernel heap memory.

Bump pixfmt fwht.sizeimage mult from 3 to 4, matching the largest components num among the supported raw formats, so the capture buffer is always large enough for the unencoded fallback.