CVE-2026-89882

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An index underflow exists in the st ref pic set prediction() function within the RKVDEC HEVC decoder. The issue occurs when calculating the reference RPS index using the formula st rps idx - (delta idx minus1 + 1). Because both operands are u8 (unsigned 8-bit integers), if delta idx minus1 + 1 exceeds the current index, the subtraction wraps around, leading to an out-of-bounds read when accessing the calculated rps st sets array. A userspace V4L2 client with access to the RKVDEC m2m decoder can trigger this by submitting an EXT SPS ST RPS control with INTER REF PIC SET PRED enabled and a specifically crafted delta idx minus1 value.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.