{"id":"CVE-2026-89882","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: rkvdec: hevc: guard INTER_REF_PIC_SET_PRED index underflow\n\nst_ref_pic_set_prediction() computes the reference RPS index as\nst_rps_idx - (delta_idx_minus1 + 1) p…","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: rkvdec: hevc: guard INTER_REF_PIC_SET_PRED index underflow\n\nst_ref_pic_set_prediction() computes the reference RPS index as\nst_rps_idx - (delta_idx_minus1 + 1) p…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","vendor":"Linux","product":"Linux","affected":["Linux >= c9a59dc2acc72789d5c778af080d1e65af84862c < 74938f83a8abbee8f502dfb5d94213b2497d1edf","Linux >= c9a59dc2acc72789d5c778af080d1e65af84862c < 052c5ed5a1d96a6b24fd50ccda16fc6841ee7ca3","Linux 7.0"],"published":"2026-09-16","updated":"2026-09-16","sourceUpdated":"2026-09-16T15:18:14.850","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-89882","references":[{"url":"https://git.kernel.org/stable/c/052c5ed5a1d96a6b24fd50ccda16fc6841ee7ca3","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/74938f83a8abbee8f502dfb5d94213b2497d1edf","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"tags":["nvd","cve.org"],"ingestedAt":"2026-09-16T10:53:53.984Z","epss":0.00154,"epssPercentile":0.04916,"slug":"CVE-2026-89882","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmedia: rkvdec: hevc: guard INTER_REF_PIC_SET_PRED index underflow\n\nst_ref_pic_set_prediction() computes the reference RPS index as\nst_rps_idx - (delta_idx_minus1 + 1) per HEVC spec equation 7-59.\nBoth operands are u8, so when delta_idx_minus1 + 1 exceeds the\ncurrent index the subtraction wraps and the subsequent array access\nat calculated_rps_st_sets[ref_rps_idx] reads far out of bounds.\n\nA userspace V4L2 client that can open the RKVDEC m2m decoder can\nsubmit an EXT_SPS_ST_RPS control with INTER_REF_PIC_SET_PRED set\nand delta_idx_minus1 crafted to trigger the underflow.\n\nReject the entry early when the reference index would underflow.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":205182,"id":"CVE-2026-89882","ts":1789570705620,"field":"cvss","old":null,"new":"7.8"},{"seq":205181,"id":"CVE-2026-89882","ts":1789570705620,"field":"severity","old":"none","new":"high"}]}