{"id":"AZL-110561","summary":"CVE-2026-98882 affecting package kernel 6.6.157.1-1","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: chips-media: wave5: Add range checks for dec_output_info\n\nIf the driver's dec_output_info contains invalid data the driver can\nwrite in invalid memory. Add a range check for that.\n\nThis fixes this smatch error:\ndrivers/media/platform/chips-media/wave5/wave5-vpuapi.c:588 wave5_vpu_dec_get_output_info() error: buffer overflow 'inst-\u003eframe_buf' 64 \u003c= 127","modified":"2026-10-26T05:32:42Z","published":"2026-10-23T12:18:21Z","upstream":["CVE-2026-98882"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98882"}],"affected":[{"package":{"name":"kernel","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/kernel"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"6.6.157.1-1"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-110561.json"}}],"schema_version":"1.9.0"}