CVE-2026-89724: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-89724 Overview

CVE-2026-89724 is an out-of-bounds write vulnerability in the Linux kernel's vicodec virtual media driver. The flaw resides in the Fast Walsh-Hadamard Transform (FWHT) encoder path within fwht_encode_frame(). When a 4-component pixel format is processed and every plane traverses the FWHT_FRAME_UNENCODED fallback in encode_plane(), the encoder writes more bytes than the CAPTURE buffer was sized to hold. The buffer size is computed from pixfmt_fwht.sizeimage_mult = 3, but a 4-component frame requires a multiplier of 4. The overflow corrupts adjacent kernel heap memory.

Critical Impact
A local, authenticated user with access to the /dev/video* interface exposed by the vicodec driver can trigger a kernel heap out-of-bounds write, enabling memory corruption that may lead to privilege escalation or kernel compromise.

Affected Products

Linux kernel media/vicodec driver (mainline, prior to fix)
Linux stable kernel branches referenced by commits 6ea647e, 84cfebf, 8c14472, b95315f, cf4500e, d40838a, e21cccc, and f7ae26c
Distributions shipping vulnerable kernel versions with the vicodec module enabled

Discovery Timeline

2026-09-11 - CVE-2026-89724 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-89724

Vulnerability Analysis

The vicodec driver implements a virtual codec used for testing V4L2 stateful codec interfaces. The vidioc_s_fmt_vid_out() function sizes the encoder CAPTURE buffer using the compressed descriptor pixfmt_fwht, whose sizeimage_mult field is 3. The resulting buffer size is coded_w * coded_h * 3 + sizeof(struct fwht_cframe_hdr). This sizing assumes at most three full-resolution planes.

The encoder in fwht_encode_frame() iterates one plane per component. When a plane cannot be compressed, encode_plane() takes the FWHT_FRAME_UNENCODED path and copies the plane data verbatim into the output buffer. For raw formats declaring four full-resolution components (components_num == 4, with width_div == height_div == 1), the encoder emits sizeof(struct fwht_cframe_hdr) + 4 * coded_w * coded_h bytes. That exceeds the allocated buffer by exactly coded_w * coded_h bytes.

Root Cause

The root cause is an inconsistency between the CAPTURE buffer sizing constant and the maximum number of encoded planes the driver actually writes. The compressed pixel format descriptor uses sizeimage_mult = 3, but the encoder can process up to four full-resolution planes when the unencoded fallback is triggered on every plane.

Attack Vector

Exploitation requires local access and permission to open the vicodec V4L2 device node. A user submits a 4-component raw pixel format on the OUTPUT queue and provides frame content that resists FWHT compression on every plane, forcing all planes through the verbatim copy path. The subsequent memcpy overruns the CAPTURE buffer allocation, corrupting adjacent slab objects on the kernel heap.

No verified public exploit is currently available. Refer to the upstream commits, including Linux Kernel Commit 6ea647e and Linux Kernel Commit f7ae26c, for the authoritative fix details.

Detection Methods for CVE-2026-89724

Indicators of Compromise

Unexpected kernel warnings, KASAN slab-out-of-bounds reports, or BUG: messages referencing fwht_encode_frame or encode_plane in dmesg.
Unexplained kernel oops or panics on hosts where the vicodec module is loaded.
Non-privileged processes opening /dev/video* nodes bound to the vicodec driver.

Detection Strategies

Enable CONFIG_KASAN on test kernels to surface the out-of-bounds write during fuzzing of V4L2 codec interfaces.
Audit loaded kernel modules for vicodec on production systems where it should not be present.
Monitor ioctl syscalls targeting V4L2 devices, particularly VIDIOC_S_FMT and VIDIOC_QBUF, issued by unexpected processes.

Monitoring Recommendations

Collect auditd events for opens on /dev/video* device nodes and correlate with process lineage.
Ship kernel ring buffer telemetry into a centralized log platform to detect KASAN and slab corruption signatures.
Alert on modprobe or insmod activity that loads the vicodec module on production kernels.

How to Mitigate CVE-2026-89724

Immediate Actions Required

Apply the upstream Linux kernel patches that bump pixfmt_fwht.sizeimage_mult from 3 to 4.
On systems that do not require virtual codec testing, unload and blacklist the vicodec module.
Restrict access to /dev/video* device nodes to trusted users and groups only.

Patch Information

The fix increases pixfmt_fwht.sizeimage_mult from 3 to 4, matching the largest components_num among the supported raw formats. This ensures the CAPTURE buffer is always sized for the worst-case unencoded fallback. Patches are available across stable branches: 6ea647e, 84cfebf, 8c14472, b95315f, cf4500e, d40838a, e21cccc, and f7ae26c. Consume distribution kernel updates as they become available.

Workarounds

Blacklist the vicodec module on production systems using /etc/modprobe.d/blacklist-vicodec.conf.
Tighten permissions on /dev/video* nodes so only trusted service accounts can invoke V4L2 ioctl calls.
Where feasible, rebuild kernels without CONFIG_VIDEO_VICODEC until patched packages are deployed.

bash

# Blacklist the vicodec module and prevent auto-load
echo "blacklist vicodec" | sudo tee /etc/modprobe.d/blacklist-vicodec.conf
echo "install vicodec /bin/true" | sudo tee -a /etc/modprobe.d/blacklist-vicodec.conf

# Unload if currently loaded
sudo modprobe -r vicodec

# Verify the module is not present
lsmod | grep vicodec || echo "vicodec not loaded"