EUVD-2026-80473
GHSA-p727-h8jp-cv82
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local device-node access (AV:L/PR:L); AC:H because it needs crafted out-of-range controls plus a decoder driver that walks the arrays unbounded; impact is crash-dominant (A:H) with conditional C:L/I:L OOB access.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
6DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
media: v4l2-ctrls: validate HEVC EXT SPS RPS counts
The HEVC SPS control carries the short-term and long-term RPS counts that decoder drivers use to walk the matching EXT SPS dynamic arrays. Reject SPS values that exceed the HEVC limits of 64 short-term sets and 32 long-term references so drivers cannot later index beyond those controls.
Also reject EXT SPS ST RPS entries whose negative or positive picture counts exceed the 16-entry arrays, or whose combined delta-POC count exceeds the HEVC DPB maximum.
AnalysisAI
Out-of-bounds array access in the Linux kernel V4L2 control framework for stateless HEVC decoders lets a local user who can write to a V4L2 device node (/dev/video*) supply HEVC SPS short-term and long-term reference picture set counts that exceed the HEVC limits of 64 ST RPS sets and 32 LT references, so a decoder driver that trusts those counts can index past the EXT SPS dynamic arrays. The published CVSS vector rates this as 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), whereas our independent assessment scores it lower (AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H) because the flaw only manifests when a stateless HEVC decoder driver consumes the attacker-supplied counts without performing its own bounds validation; there is no public exploit identified at time of analysis and no CISA KEV entry. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires local access to a V4L2 stateless HEVC decoder interface (a /dev/video* device node exposing the HEVC SPS/EXT SPS controls) and the ability to submit control values, consistent with CVSS PR:L. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a local, authenticated (PR:L per CVSS vector) input-validation flaw in the Linux kernel V4L2 control framework for stateless HEVC decoders, not a remotely reachable issue. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: update to Linux 7.2.5 or 7.3-rc1, or backport the upstream stable commits 30f85a7c59113a8844b276efc010085a34f912e9 and 796b5c6d4f1615d59d5d8fe5a38fae6bfdfe878e (see https://git.kernel.org/stable/c/30f85a7c59113a8844b276efc010085a34f912e9 and https://git.kernel.org/stable/c/796b5c6d4f1615d59d5d8fe5a38fae6bfdfe878e; advisory mirror at https://nvd.nist.gov/vuln/detail/CVE-2026-89873). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Linux systems that expose V4L2 video device nodes and identify those using stateless HEVC decoder drivers; restrict /dev/video* permissions to trusted accounts and remove unnecessary video device access. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today