Bug 2513425 (CVE-2026-68206)

Summary: CVE-2026-68206 kernel: media: v4l2-ctrls: validate HEVC active reference counts
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: rhel-process-autobot, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in the Linux kernel's V4L2 controls for High Efficiency Video Coding (HEVC). The common validation path for HEVC slice parameters does not properly verify the active L0/L1 reference counts before driver-specific code processes them. This lack of validation could allow a local user or application to provide malformed HEVC slice parameters, potentially leading to unexpected behavior or system instability.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-08-10 12:36:37 UTC 
In the Linux kernel, the following vulnerability has been resolved:

media: v4l2-ctrls: validate HEVC active reference counts

HEVC slice parameters are shared stateless V4L2 controls, but the common
validation path does not verify the active L0/L1 reference counts before
driver-specific code consumes them.

The original report came from Cedrus, but the active count bounds are
not Cedrus-specific. Validate them in the common HEVC slice control path
so stateless HEVC drivers get the same basic guarantees as soon as the
control is queued.

Do not reject ref_idx_l0/ref_idx_l1 entries here. Existing userspace may
use out-of-range sentinel values such as 0xff for missing references, and
some hardware can use that information for concealment. Keep this common
check limited to the active reference counts.
Comment 1 Mauro Matteo Cascella 2026-08-11 13:52:28 UTC 
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2026081012-CVE-2026-68206-45ac@gregkh/T