CVE-2026-98882

What it actually does

Missing range validation on dec_output_info allows invalid index values to trigger a buffer overflow write into inst->frame_buf beyond its 64-entry limit.

Why it matters to the business

Systems performing hardware-accelerated video decode on affected Linux kernels risk kernel memory corruption that can cause crashes, denial of service, or local privilege escalation.

How an attack unfolds

An attacker supplies a maliciously crafted decoder output structure to the wave5 VPU driver; the missing bounds check in wave5_vpu_dec_get_output_info permits an out-of-bounds write into the frame buffer array.

How to fix it

Apply the upstream kernel patch that adds range checks for dec_output_info in wave5-vpuapi.c; rebuild and deploy the fixed kernel image.

How to confirm the fix worked

Confirm presence of the range-check commit in the running kernel source or verify that wave5_vpu_dec_get_output_info no longer contains the smatch-reported overflow.

Typical attack path

1. Obtain local access or deliver crafted media to a process using the wave5 decoder
2. Trigger decoder output path with invalid dec_output_info index
3. Overflow writes past end of inst->frame_buf
4. Corrupt adjacent kernel structures to achieve code execution or crash

How to detect it

Search kernel logs for wave5 driver faults, buffer overflow warnings, or crashes in wave5_vpu_dec_get_output_info; review audit logs for unexpected decoder usage.

• wave5_vpu_dec_get_output_info
• buffer overflow 'inst->frame_buf' 64 <= 127
• drivers/media/platform/chips-media/wave5/wave5-vpuapi.c:588

What your security team should do

• Prioritize kernel update on any system exposing the chips-media wave5 driver
• Restrict untrusted media decode workloads until patched
• Monitor for kernel oops or panic reports referencing wave5