Linux Kernel CVE-2026-68229

The Cedrus driver is a V4L2 stateless video decode driver for Allwinner SoC hardware (commonly found in ARM-based single-board computers). In stateless H.264 decoding, the application submits reference picture lists (ref_pic_list0/ref_pic_list1) as part of a V4L2_H264_SLICE_PARAMS control structure. These lists can legitimately contain out-of-range index values as sentinel entries for missing references - a valid condition in the H.264 spec. The Cedrus driver's _cedrus_write_ref_list() function previously passed these indices directly into decode->dpb[] without checking them against the fixed-size V4L2_H264_NUM_DPB_ENTRIES boundary, resulting in an out-of-bounds read of kernel heap memory. No formal CWE was assigned, but the root cause maps to CWE-125 (Out-of-bounds Read). The fix guards the DPB lookup locally in the driver and skips invalid entries, preserving compatibility with existing userspace that legitimately generates such indices.