{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-68206", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-30T09:28:09.374Z", "datePublished": "2026-08-10T12:00:25.309Z", "dateUpdated": "2026-08-19T16:31:26.837Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-19T16:31:26.837Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: v4l2-ctrls: validate HEVC active reference counts\n\nHEVC slice parameters are shared stateless V4L2 controls, but the common\nvalidation path does not verify the active L0/L1 reference counts before\ndriver-specific code consumes them.\n\nThe original report came from Cedrus, but the active count bounds are\nnot Cedrus-specific. Validate them in the common HEVC slice control path\nso stateless HEVC drivers get the same basic guarantees as soon as the\ncontrol is queued.\n\nDo not reject ref_idx_l0/ref_idx_l1 entries here. Existing userspace may\nuse out-of-range sentinel values such as 0xff for missing references, and\nsome hardware can use that information for concealment. Keep this common\ncheck limited to the active reference counts."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The control is only settable through VIDIOC_S_EXT_CTRLS on the local V4L2 stateless decoder node (/dev/videoN), followed by QBUF/STREAMON on the same fd. There is no network or remote path into the HEVC slice-params control.\nAC:L - The attacker supplies num_ref_idx_l0/l1_active_minus1 verbatim as a u8; any value in 16..254 deterministically drives the loops in cedrus_h265_is_low_delay() and rkvdec_hevc set_ps_field() out of bounds on the very next decode run. No race, timing window, or uncontrollable memory layout is involved.\nPR:L - Only an unprivileged local account holding the video device node is required (typically the 'video' group, or the media/codec service reachable from sandboxed apps on Android and embedded Allwinner/Rockchip devices). cedrus_try_ctrl() checks only SPS chroma format and bit depth; no capability or root check exists on the path.\nUI:N - The attacking process performs the whole sequence itself: open the decoder, set the crafted HEVC slice-params control, queue buffers and start streaming. No victim action, media file, or mount is needed.\nS:U - The out-of-bounds accesses stay inside the kernel's own slab and DMA memory within the same security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - decode_params->dpb[] holds 16 16-byte entries at the tail of a ~336-byte control allocation, so an index up to 255 reads roughly 3.8 KB of adjacent kernel heap; the pred-weight loops likewise read 240 bytes past slice_params. Those OOB bytes are fed into decoder SRAM and steer the low-delay decision, giving an attacker-steerable oracle over unrelated kernel memory.\nI:H - In rkvdec-hevc, REF_PIC_IDX_L0(i)/REF_PIC_LONG_TERM_L1(i) with i up to 255 resolve to bit offset ~1276 in an 8-word rkvdec_rps_packet, so set_ps_field() performs an out-of-bounds write of attacker-chosen bits at an attacker-chosen offset into (and past the end of) the coherent DMA priv_tbl, corrupting hardware descriptor state and adjacent memory.\nA:H - Reading several kilobytes past a slab object can walk into an unmapped or poisoned region and trips KASAN/hardening checks, while the rkvdec out-of-bounds write corrupts the DMA table handed to the decoder; either yields a kernel oops or wedged hardware, repeatable at will from an unprivileged process."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/media/v4l2-core/v4l2-ctrls-core.c"], "versions": [{"version": "d395a78db9eabd12633b39e05c80e803543b6590", "lessThan": "3299c3905f3fb439ebd892658b87bc76c93ae116", "status": "affected", "versionType": "git"}, {"version": "d395a78db9eabd12633b39e05c80e803543b6590", "lessThan": "9a998cc1c348769262d433acb7d238c5fac4b2e0", "status": "affected", "versionType": "git"}, {"version": "d395a78db9eabd12633b39e05c80e803543b6590", "lessThan": "dbaf0e0023e2f9332c5164822def7f80b7d2c5ef", "status": "affected", "versionType": "git"}, {"version": "d395a78db9eabd12633b39e05c80e803543b6590", "lessThan": "3068ab802fc98b121dcb451e1f7f4d338ffc7a19", "status": "affected", "versionType": "git"}, {"version": "d395a78db9eabd12633b39e05c80e803543b6590", "lessThan": "b01df98a6669d2b67d8aed816021b327fd905998", "status": "affected", "versionType": "git"}, {"version": "d395a78db9eabd12633b39e05c80e803543b6590", "lessThan": "afbe4bc252d90a6f8fad869b06d5430f615f22f9", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/media/v4l2-core/v4l2-ctrls-core.c"], "versions": [{"version": "5.14", "status": "affected"}, {"version": "0", "lessThan": "5.14", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.183", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.148", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.101", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.42", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.6", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.14", "versionEndExcluding": "6.1.183"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.14", "versionEndExcluding": "6.6.148"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.14", "versionEndExcluding": "6.12.101"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.14", "versionEndExcluding": "6.18.42"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.14", "versionEndExcluding": "7.1.6"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.14", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/3299c3905f3fb439ebd892658b87bc76c93ae116"}, {"url": "https://git.kernel.org/stable/c/9a998cc1c348769262d433acb7d238c5fac4b2e0"}, {"url": "https://git.kernel.org/stable/c/dbaf0e0023e2f9332c5164822def7f80b7d2c5ef"}, {"url": "https://git.kernel.org/stable/c/3068ab802fc98b121dcb451e1f7f4d338ffc7a19"}, {"url": "https://git.kernel.org/stable/c/b01df98a6669d2b67d8aed816021b327fd905998"}, {"url": "https://git.kernel.org/stable/c/afbe4bc252d90a6f8fad869b06d5430f615f22f9"}], "title": "media: v4l2-ctrls: validate HEVC active reference counts", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/media/v4l2-core/v4l2-ctrls-core.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "3299c3905f3fb439ebd892658b87bc76c93ae116", "status": "affected", "version": "d395a78db9eabd12633b39e05c80e803543b6590", "versionType": "git"}, {"lessThan": "9a998cc1c348769262d433acb7d238c5fac4b2e0", "status": "affected", "version": "d395a78db9eabd12633b39e05c80e803543b6590", "versionType": "git"}, {"lessThan": "dbaf0e0023e2f9332c5164822def7f80b7d2c5ef", "status": "affected", "version": "d395a78db9eabd12633b39e05c80e803543b6590", "versionType": "git"}, {"lessThan": "3068ab802fc98b121dcb451e1f7f4d338ffc7a19", "status": "affected", "version": "d395a78db9eabd12633b39e05c80e803543b6590", "versionType": "git"}, {"lessThan": "b01df98a6669d2b67d8aed816021b327fd905998", "status": "affected", "version": "d395a78db9eabd12633b39e05c80e803543b6590", "versionType": "git"}, {"lessThan": "afbe4bc252d90a6f8fad869b06d5430f615f22f9", "status": "affected", "version": "d395a78db9eabd12633b39e05c80e803543b6590", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/media/v4l2-core/v4l2-ctrls-core.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.14"}, {"lessThan": "5.14", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.183", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.148", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.101", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.42", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.6", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: v4l2-ctrls: validate HEVC active reference counts\n\nHEVC slice parameters are shared stateless V4L2 controls, but the common\nvalidation path does not verify the active L0/L1 reference counts before\ndriver-specific code consumes them.\n\nThe original report came from Cedrus, but the active count bounds are\nnot Cedrus-specific. Validate them in the common HEVC slice control path\nso stateless HEVC drivers get the same basic guarantees as soon as the\ncontrol is queued.\n\nDo not reject ref_idx_l0/ref_idx_l1 entries here. Existing userspace may\nuse out-of-range sentinel values such as 0xff for missing references, and\nsome hardware can use that information for concealment. Keep this common\ncheck limited to the active reference counts."}], "id": "CVE-2026-68206", "lastModified": "2026-08-19T17:20:36.550", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-08-10T13:20:08.273", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/3068ab802fc98b121dcb451e1f7f4d338ffc7a19"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/3299c3905f3fb439ebd892658b87bc76c93ae116"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/9a998cc1c348769262d433acb7d238c5fac4b2e0"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/afbe4bc252d90a6f8fad869b06d5430f615f22f9"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b01df98a6669d2b67d8aed816021b327fd905998"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/dbaf0e0023e2f9332c5164822def7f80b7d2c5ef"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: media: v4l2-ctrls: validate HEVC active reference counts", "id": "2513425", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2513425"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-1284", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nmedia: v4l2-ctrls: validate HEVC active reference counts\nHEVC slice parameters are shared stateless V4L2 controls, but the common\nvalidation path does not verify the active L0/L1 reference counts before\ndriver-specific code consumes them.\nThe original report came from Cedrus, but the active count bounds are\nnot Cedrus-specific. Validate them in the common HEVC slice control path\nso stateless HEVC drivers get the same basic guarantees as soon as the\ncontrol is queued.\nDo not reject ref_idx_l0/ref_idx_l1 entries here. Existing userspace may\nuse out-of-range sentinel values such as 0xff for missing references, and\nsome hardware can use that information for concealment. Keep this common\ncheck limited to the active reference counts.", "A flaw was found in the Linux kernel's V4L2 controls for High Efficiency Video Coding (HEVC). The common validation path for HEVC slice parameters does not properly verify the active L0/L1 reference counts before driver-specific code processes them. This lack of validation could allow a local user or application to provide malformed HEVC slice parameters, potentially leading to unexpected behavior or system instability."], "name": "CVE-2026-68206", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-10T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-68206\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-68206\nhttps://lore.kernel.org/linux-cve-announce/2026081012-CVE-2026-68206-45ac@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d395a78db9eabd12633b39e05c80e803543b6590,9a998cc1c348769262d433acb7d238c5fac4b2e0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d395a78db9eabd12633b39e05c80e803543b6590,dbaf0e0023e2f9332c5164822def7f80b7d2c5ef)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d395a78db9eabd12633b39e05c80e803543b6590,3068ab802fc98b121dcb451e1f7f4d338ffc7a19)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d395a78db9eabd12633b39e05c80e803543b6590,b01df98a6669d2b67d8aed816021b327fd905998)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d395a78db9eabd12633b39e05c80e803543b6590,afbe4bc252d90a6f8fad869b06d5430f615f22f9)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "5.14"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,5.14)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.148,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.101,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.42,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.6,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2-rc1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-10T14:30:04.127365+00:00", "updated": "2026-08-14T01:45:08.191896+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}