Go to homepageCyberStrike

Menu

Star on GitHub · 3.4k
Sign inDownload

CVE-2026-89882

7.8 · HIGH

In the Linux kernel, the following vulnerability has been resolved: media: rkvdec: hevc: guard INTER_REF_PIC_SET_PRED index underflow st_ref_pic_set_prediction() computes the reference RPS index…

Published Sep 16, 2026EPSS 0.17%

Overview

CVE-2026-89882 is a high-severity vulnerability. It was published on September 16, 2026 and has a CVSS 3.1 base score of 7.8 (HIGH).

This vulnerability has a CVSS 3.1 base score of 7.8, rated HIGH. It requires local or adjacent network access to exploit. Some level of privileges is required for exploitation.

Technical description

In the Linux kernel, the following vulnerability has been resolved:

media: rkvdec: hevc: guard INTER_REF_PIC_SET_PRED index underflow

st_ref_pic_set_prediction() computes the reference RPS index as

st_rps_idx - (delta_idx_minus1 + 1) per HEVC spec equation 7-59.

Both operands are u8, so when delta_idx_minus1 + 1 exceeds the

current index the subtraction wraps and the subsequent array access

at calculated_rps_st_sets[ref_rps_idx] reads far out of bounds.

A userspace V4L2 client that can open the RKVDEC m2m decoder can

submit an EXT_SPS_ST_RPS control with INTER_REF_PIC_SET_PRED set

and delta_idx_minus1 crafted to trigger the underflow.

Reject the entry early when the reference index would underflow.

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References

Refgit.kernel.org/stable/c/052c5ed5a1d96a6b24fd50ccda16fc6841ee7ca3Refgit.kernel.org/stable/c/74938f83a8abbee8f502dfb5d94213b2497d1edf

How CyberStrike helps

Frequently asked questions

What is CVE-2026-89882?

CVE-2026-89882 is a high-severity vulnerability. It was published on September 16, 2026 and has a CVSS 3.1 base score of 7.8 (HIGH).

How severe is CVE-2026-89882?

This vulnerability has a CVSS 3.1 base score of 7.8, rated HIGH. It requires local or adjacent network access to exploit. Some level of privileges is required for exploitation.

How do I fix or remediate CVE-2026-89882?

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

How can CyberStrike help with CVE-2026-89882?

CyberStrike is an open-source, AI-augmented pentesting engine. Rather than flag a version number, it tests whether an issue like CVE-2026-89882 is actually reachable in your own applications and APIs, then verifies each finding before reporting it. That tells you if the weakness is a real, exploitable risk in your environment or a false positive you can safely deprioritize.

Related HIGH CVEs from 2026

View all
Browse by year2026202520242023202220212020201920182017201620152014201320122011201020092008200720062005200420032002200120001999
LiveWatch live →