CVE-2026-68229

Received Received - Intake

Media: cedrus H.264 Reference List Out-of-Bounds Read

Publication date: 2026-08-10

Last updated on: 2026-08-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: media: cedrus: skip invalid H.264 reference list entries Cedrus consumes H.264 ref_pic_list0/ref_pic_list1 entries from the stateless slice control and later uses their indices to look up decode->dpb[] in _cedrus_write_ref_list(). Rejecting such controls in cedrus_try_ctrl() would break existing userspace, since stateless H.264 reference lists may legitimately carry out-of-range indices for missing references. Instead, guard the actual DPB lookup in Cedrus and skip entries whose indices do not fit the fixed V4L2_H264_NUM_DPB_ENTRIES array. This keeps the fix local to the driver use site and avoids out-of-bounds reads from malformed or unsupported reference list entries.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-10

Last Modified

2026-08-19

Generated

2026-08-30

AI Q&A

2026-08-10

EPSS Evaluated

2026-08-29

NVD

CVE-2026-68229

EUVD

EUVD-2026-55330

Affected Vendors & Products

Vendor	Product	Version / Range
cedrus	cedrus	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves the Cedrus media driver incorrectly handling H.264 reference list entries. The driver uses indices from user-provided controls to access an array, which could lead to out-of-bounds reads if the indices are invalid or unsupported. The fix skips invalid entries instead of rejecting them to avoid breaking existing userspace applications.

Detection Guidance

This vulnerability is specific to the Linux kernel's Cedrus media driver and relates to H.264 video decoding. Detection requires checking kernel logs for errors related to cedrus or H.264 decoding, such as out-of-bounds read warnings or invalid reference list entries.

Impact Analysis

This vulnerability could allow an attacker to cause a denial of service or potentially execute arbitrary code in the kernel by providing malformed H.264 reference list entries. It may also lead to system instability or crashes if exploited.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it pertains to a driver-level issue in the Linux kernel's media subsystem. The flaw involves out-of-bounds reads in the Cedrus video decoder but does not involve data exposure, unauthorized access, or privacy violations that these regulations typically address.

Mitigation Strategies

Update your Linux kernel to the latest stable version that includes the fix for this issue. Monitor kernel logs for cedrus-related errors after updating. If you cannot update immediately, avoid processing H.264 video streams until patched.

Hi! I’m here to help you understand CVE-2026-68229. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70