{"id":"CVE-2026-68206","summary":"media: v4l2-ctrls: validate HEVC active reference counts","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: v4l2-ctrls: validate HEVC active reference counts\n\nHEVC slice parameters are shared stateless V4L2 controls, but the common\nvalidation path does not verify the active L0/L1 reference counts before\ndriver-specific code consumes them.\n\nThe original report came from Cedrus, but the active count bounds are\nnot Cedrus-specific. Validate them in the common HEVC slice control path\nso stateless HEVC drivers get the same basic guarantees as soon as the\ncontrol is queued.\n\nDo not reject ref_idx_l0/ref_idx_l1 entries here. Existing userspace may\nuse out-of-range sentinel values such as 0xff for missing references, and\nsome hardware can use that information for concealment. Keep this common\ncheck limited to the active reference counts.","modified":"2026-08-12T04:18:46.573792410Z","published":"2026-08-10T12:00:25.309Z","database_specific":{"cna_assigner":"Linux","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68206.json"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/3068ab802fc98b121dcb451e1f7f4d338ffc7a19"},{"type":"WEB","url":"https://git.kernel.org/stable/c/9a998cc1c348769262d433acb7d238c5fac4b2e0"},{"type":"WEB","url":"https://git.kernel.org/stable/c/afbe4bc252d90a6f8fad869b06d5430f615f22f9"},{"type":"WEB","url":"https://git.kernel.org/stable/c/b01df98a6669d2b67d8aed816021b327fd905998"},{"type":"WEB","url":"https://git.kernel.org/stable/c/dbaf0e0023e2f9332c5164822def7f80b7d2c5ef"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68206.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68206"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"d395a78db9eabd12633b39e05c80e803543b6590"},{"fixed":"9a998cc1c348769262d433acb7d238c5fac4b2e0"},{"fixed":"dbaf0e0023e2f9332c5164822def7f80b7d2c5ef"},{"fixed":"3068ab802fc98b121dcb451e1f7f4d338ffc7a19"},{"fixed":"b01df98a6669d2b67d8aed816021b327fd905998"},{"fixed":"afbe4bc252d90a6f8fad869b06d5430f615f22f9"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-68206.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.14.0"},{"fixed":"6.6.148"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0"},{"fixed":"6.12.101"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.42"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"7.1.6"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-68206.json"}}],"schema_version":"1.9.0"}