Cloudanix VulnDB

CVE-2026-68229

High · 7.1

CVSS

7.1

EPSS

0.2%

Published

Aug 10, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in video handling code on certain Linux devices could let someone already on the machine peek at private memory or make the system unstable.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Low
Impact
Data Exposure
Component
OS kernel
Class
Information Disclosure
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Out-of-bounds read in the Cedrus V4L2 driver when _cedrus_write_ref_list dereferences invalid indices from H.264 ref_pic_list0/ref_pic_list1 supplied via stateless slice controls, bypassing the fixed V4L2_H264_NUM_DPB_ENTRIES bounds check.

Why it matters to the business

Local users on Linux systems using Allwinner-based media hardware can read kernel memory contents or trigger crashes, potentially exposing sensitive data or causing denial of service on video-encoding workloads.

How an attack unfolds

An attacker with local access crafts a V4L2 stateless H.264 control structure containing out-of-range reference indices that are accepted by cedrus_try_ctrl, then submits it to trigger decode operations that perform unsafe DPB lookups.

How to fix it

Update the Linux kernel to a version containing the guard that skips invalid reference-list entries inside _cedrus_write_ref_list before any DPB lookup occurs.

How to confirm the fix worked

Confirm presence of the bounds check on reference indices against V4L2_H264_NUM_DPB_ENTRIES in the cedrus driver source; test with deliberately malformed reference lists to verify they are now skipped without OOB reads.

Typical attack path

  1. Obtain local access on a system exposing the Cedrus driver
  2. Open the V4L2 media device and configure a stateless H.264 context
  3. Populate ref_pic_list0 or ref_pic_list1 with indices outside the DPB array
  4. Submit the slice control and trigger decode to force the out-of-bounds access
  5. Observe kernel memory disclosure or panic

How to detect it

Inspect kernel logs for cedrus driver faults, page faults inside _cedrus_write_ref_list, or unusual V4L2 control submissions containing H.264 reference lists; correlate with processes using the media device.

  • _cedrus_write_ref_list
  • V4L2_H264_NUM_DPB_ENTRIES
  • cedrus_try_ctrl

What your security team should do

  • Prioritize kernel updates on any system exposing the Cedrus media driver
  • Restrict untrusted local access to V4L2 devices until patched
  • Monitor kernel logs for cedrus-related oops or page-fault warnings

The record

In the Linux kernel, the following vulnerability has been resolved: media: cedrus: skip invalid H.264 reference list entries Cedrus consumes H.264 ref_pic_list0/ref_pic_list1 entries from the stateless slice control and later uses their indices to look up decode->dpb[] in _cedrus_write_ref_list(). Rejecting such controls in cedrus_try_ctrl() would break existing userspace, since stateless H.264 reference lists may legitimately carry out-of-range indices for missing references. Instead, guard the actual DPB lookup in Cedrus and skip entries whose indices do not fit the fixed V4L2_H264_NUM_DPB_ENTRIES array. This keeps the fix local to the driver use site and avoids out-of-bounds reads from malformed or unsupported reference list entries.

Affected packages

Ecosystem Package Introduced Fixed