Cloudanix VulnDB

CVE-2026-68206

None

CVSS

—

EPSS

0.2%

Published

Aug 10, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A missing check in Linux video handling code could let bad data slip through and cause crashes or security problems when processing certain video streams.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Moderate
Impact
Full Compromise
Component
OS kernel
Class
Improper Input Validation
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Missing validation of active L0/L1 reference counts in shared stateless HEVC V4L2 slice controls allows invalid values to reach driver-specific code paths before consumption.

Why it matters to the business

Linux systems handling HEVC video encoding or decoding may experience kernel instability, crashes, or potential security bypasses during media processing workloads.

How an attack unfolds

An attacker supplies crafted HEVC slice parameter controls via V4L2 ioctl interfaces with out-of-bounds active reference counts; the common validation path accepts them and passes them to stateless HEVC drivers that consume the values without further checks, leading to undefined behavior.

How to fix it

Update to a Linux kernel version that includes the common HEVC slice control validation for active reference counts; rebuild and deploy any custom media drivers after applying the fix.

How to confirm the fix worked

Confirm the presence of the validation logic in v4l2-ctrls.c for HEVC slice parameters and test with out-of-range active reference count inputs to ensure rejection occurs before driver dispatch.

Typical attack path

  1. Identify a Linux system exposing V4L2 stateless HEVC controls
  2. Craft malicious v4l2_ctrl_hevc_slice_params with invalid active_num_l0/active_num_l1 values
  3. Queue the control via VIDIOC_S_CTRL or equivalent
  4. Trigger driver consumption of the unvalidated reference counts

How to detect it

Review kernel logs for v4l2 control validation warnings or driver faults involving HEVC slice parameters; inspect application code submitting v4l2_ctrl_hevc_slice_params structures for unvalidated active counts.

What your security team should do

  • Prioritize kernel updates on systems using stateless HEVC V4L2 drivers
  • Audit media pipelines for direct use of v4l2_ctrl_hevc_slice_params
  • Monitor for kernel oops or panics in v4l2 or cedrus-related code paths

The record

In the Linux kernel, the following vulnerability has been resolved: media: v4l2-ctrls: validate HEVC active reference counts HEVC slice parameters are shared stateless V4L2 controls, but the common validation path does not verify the active L0/L1 reference counts before driver-specific code consumes them. The original report came from Cedrus, but the active count bounds are not Cedrus-specific. Validate them in the common HEVC slice control path so stateless HEVC drivers get the same basic guarantees as soon as the control is queued. Do not reject ref_idx_l0/ref_idx_l1 entries here. Existing userspace may use out-of-range sentinel values such as 0xff for missing references, and some hardware can use that information for concealment. Keep this common check limited to the active reference counts.

Affected packages

Ecosystem Package Introduced Fixed