What is the CVSS score of CVE-2026-68206?

CVE-2026-68206 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by CVE-2026-68206?

A memory safety vulnerability in Linux kernel video processing (CVE-2026-68206, CVSS 7.8) could allow local users to disrupt service or gain system access on machines with video decoding hardware.. A patch is available.

How to fix or mitigate CVE-2026-68206?

Within 24 hours, identify systems with HEVC video decoder hardware running Linux kernel versions 5.14 through current and consult vendor security advisories for available patches. Within 7 days, test patched kernels on staging media servers to confirm video processing workloads remain stable. Within 30 days, deploy patched kernel versions to all production systems with HEVC hardware decoders.

Linux Kernel CVE-2026-68206

EUVD-2026-55307 HIGH

2026-08-10 Linux

GHSA-qx89-rcg9-ghw4

Information Disclosure Linux

7.8

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Local V4L2 device node access requires low-privilege membership; no special timing or conditions; unvalidated kernel array index yields full memory corruption impact.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Red Hat

5.5 MEDIUM

qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 14, 2026 - 02:03 vuln.today

CVSS changed

Aug 13, 2026 - 23:37 NVD

7.8 (HIGH)

Patch available

Aug 10, 2026 - 14:18 EUVD

CVE Published

Aug 10, 2026 - 12:00 cve.org

HIGH 7.8

CVE Published

Aug 10, 2026 - 12:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

media: v4l2-ctrls: validate HEVC active reference counts

HEVC slice parameters are shared stateless V4L2 controls, but the common validation path does not verify the active L0/L1 reference counts before driver-specific code consumes them.

The original report came from Cedrus, but the active count bounds are not Cedrus-specific. Validate them in the common HEVC slice control path so stateless HEVC drivers get the same basic guarantees as soon as the control is queued.

Do not reject ref_idx_l0/ref_idx_l1 entries here. Existing userspace may use out-of-range sentinel values such as 0xff for missing references, and some hardware can use that information for concealment. Keep this common check limited to the active reference counts.

AnalysisAI

Unvalidated HEVC active reference counts in the Linux kernel's V4L2 common control path allow a local low-privileged user to trigger out-of-bounds kernel memory access on systems equipped with stateless HEVC hardware decoders. Affected kernels from the introduction of stateless HEVC support (approximately 5.14) through to the patch commits fail to check that num_active_dpb_entries values fall within valid bounds before driver-specific code (Cedrus, Hantro, etc.) consumes them. No active exploitation is confirmed - EPSS stands at 0.21% (11th percentile) and the vulnerability is not listed in CISA KEV - but patched stable releases are available across all maintained kernel branches.

Technical ContextAI

The vulnerability is rooted in the Linux kernel's V4L2 (Video4Linux2) media subsystem, specifically in the common HEVC stateless codec control handler under drivers/media/v4l2-core/v4l2-ctrls.c. HEVC (H.265) stateless decoding requires userspace to supply complete slice decode parameters via the V4L2_CTRL_TYPE_HEVC_SLICE_PARAMS control type, including reference picture list structures containing active L0 and L1 reference counts (num_active_dpb_entries). The common validation path that runs when this control is queued did not verify that these counts were within the allocated reference frame buffer array bounds. Driver-specific code in stateless HEVC drivers (e.g., Cedrus for Allwinner SoCs, Hantro for Rockchip/NXP SoCs) then consumes the unvalidated counts, potentially indexing beyond valid memory. The CWE classification was not assigned by NVD, but this maps to CWE-129 (Improper Validation of Array Index) or CWE-125 (Out-of-bounds Read). The fix centralizes active count bounds checking in the shared path so all stateless HEVC drivers inherit the same guarantee. The affected CPE is cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* with the vulnerable window anchored to commit d395a78db9eabd12633b39e05c80e803543b6590.

RemediationAI

The primary remediation is to upgrade to a patched kernel version: 6.6.148 or later for 6.6.x LTS consumers, 6.12.101 or later for 6.12.x LTS consumers, 6.18.42 or later for 6.18.x consumers, or 7.1.6 or later for 7.1.x consumers; 7.2-rc1 and later mainline releases also contain the fix. The five upstream fix commits are available at https://git.kernel.org/stable/c/9a998cc1c348769262d433acb7d238c5fac4b2e0, https://git.kernel.org/stable/c/dbaf0e0023e2f9332c5164822def7f80b7d2c5ef, https://git.kernel.org/stable/c/3068ab802fc98b121dcb451e1f7f4d338ffc7a19, https://git.kernel.org/stable/c/b01df98a6669d2b67d8aed816021b327fd905998, and https://git.kernel.org/stable/c/afbe4bc252d90a6f8fad869b06d5430f615f22f9. For systems that cannot be patched immediately, restricting access to V4L2 device nodes via udev rules (e.g., MODE='0600', GROUP='root' for /dev/video* devices) prevents unprivileged users from exercising the vulnerable code path, though this disables hardware-accelerated video decoding for all non-root processes. Alternatively, blacklisting the specific stateless HEVC driver modules (sun4i-cedrus, hantro-vpu, etc.) via /etc/modprobe.d entirely eliminates the attack surface at the cost of losing hardware-accelerated HEVC decoding capability.

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0	Not-Affected

CVE-2026-68206 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-68206

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code