---
id: CVE-2026-68206
title: 'media: v4l2-ctrls: validate HEVC active reference counts'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  media: v4l2-ctrls: validate HEVC active reference counts

  HEVC slice parameters are shared stateless V4L2 controls, but the common
  validation path does not verify the a…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= d395a78db9eabd12633b39e05c80e803543b6590 <
    3299c3905f3fb439ebd892658b87bc76c93ae116
  - >-
    Linux >= d395a78db9eabd12633b39e05c80e803543b6590 <
    9a998cc1c348769262d433acb7d238c5fac4b2e0
  - >-
    Linux >= d395a78db9eabd12633b39e05c80e803543b6590 <
    dbaf0e0023e2f9332c5164822def7f80b7d2c5ef
  - >-
    Linux >= d395a78db9eabd12633b39e05c80e803543b6590 <
    3068ab802fc98b121dcb451e1f7f4d338ffc7a19
  - >-
    Linux >= d395a78db9eabd12633b39e05c80e803543b6590 <
    b01df98a6669d2b67d8aed816021b327fd905998
  - >-
    Linux >= d395a78db9eabd12633b39e05c80e803543b6590 <
    afbe4bc252d90a6f8fad869b06d5430f615f22f9
  - Linux 5.14
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T15:45:53.723010Z'
published: '2026-08-10'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:53:03.752Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-68206'
references:
  - url: 'https://git.kernel.org/stable/c/3299c3905f3fb439ebd892658b87bc76c93ae116'
  - url: 'https://git.kernel.org/stable/c/9a998cc1c348769262d433acb7d238c5fac4b2e0'
  - url: 'https://git.kernel.org/stable/c/dbaf0e0023e2f9332c5164822def7f80b7d2c5ef'
  - url: 'https://git.kernel.org/stable/c/3068ab802fc98b121dcb451e1f7f4d338ffc7a19'
  - url: 'https://git.kernel.org/stable/c/b01df98a6669d2b67d8aed816021b327fd905998'
  - url: 'https://git.kernel.org/stable/c/afbe4bc252d90a6f8fad869b06d5430f615f22f9'
tags:
  - cve.org
epss: 0.00176
epssPercentile: 0.06681
ingestedAt: '2026-10-16T17:24:46.852Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

media: v4l2-ctrls: validate HEVC active reference counts

HEVC slice parameters are shared stateless V4L2 controls, but the common
validation path does not verify the active L0/L1 reference counts before
driver-specific code consumes them.

The original report came from Cedrus, but the active count bounds are
not Cedrus-specific. Validate them in the common HEVC slice control path
so stateless HEVC drivers get the same basic guarantees as soon as the
control is queued.

Do not reject ref_idx_l0/ref_idx_l1 entries here. Existing userspace may
use out-of-range sentinel values such as 0xff for missing references, and
some hardware can use that information for concealment. Keep this common
check limited to the active reference counts.

## Affected

- `Linux >= d395a78db9eabd12633b39e05c80e803543b6590 < 3299c3905f3fb439ebd892658b87bc76c93ae116`
- `Linux >= d395a78db9eabd12633b39e05c80e803543b6590 < 9a998cc1c348769262d433acb7d238c5fac4b2e0`
- `Linux >= d395a78db9eabd12633b39e05c80e803543b6590 < dbaf0e0023e2f9332c5164822def7f80b7d2c5ef`
- `Linux >= d395a78db9eabd12633b39e05c80e803543b6590 < 3068ab802fc98b121dcb451e1f7f4d338ffc7a19`
- `Linux >= d395a78db9eabd12633b39e05c80e803543b6590 < b01df98a6669d2b67d8aed816021b327fd905998`
- `Linux >= d395a78db9eabd12633b39e05c80e803543b6590 < afbe4bc252d90a6f8fad869b06d5430f615f22f9`
- `Linux 5.14`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.