CVE-2026-89882: Linux Kernel RKVDEC Buffer Overflow Vulnerability

CVE-2026-89882 Overview

CVE-2026-89882 is a local privilege escalation vulnerability in the Linux kernel's Rockchip Video Decoder (rkvdec) driver for High Efficiency Video Coding (HEVC). The flaw resides in the st_ref_pic_set_prediction() function within the media subsystem. When parsing the short-term reference picture set (RPS), the driver computes a reference index as st_rps_idx - (delta_idx_minus1 + 1) per HEVC specification equation 7-59. Because both operands are u8, an attacker-controlled delta_idx_minus1 value larger than the current index causes an integer underflow, resulting in an out-of-bounds array read at calculated_rps_st_sets[ref_rps_idx].

Critical Impact
A local userspace client with access to the RKVDEC Video4Linux2 (V4L2) memory-to-memory decoder can trigger the underflow through a crafted EXT_SPS_ST_RPS control, corrupting kernel memory and potentially escalating privileges.

Affected Products

Linux kernel with the rkvdec HEVC decoder driver enabled
Rockchip-based platforms exposing the RKVDEC V4L2 m2m interface
Distributions shipping affected kernel versions prior to the upstream fix

Discovery Timeline

2026-09-16 - CVE-2026-89882 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-89882

Vulnerability Analysis

The vulnerability affects the HEVC bitstream parsing logic inside the rkvdec driver. When a userspace client submits an EXT_SPS_ST_RPS control with the INTER_REF_PIC_SET_PRED flag enabled, the kernel calculates the reference RPS index by subtracting delta_idx_minus1 + 1 from the current st_rps_idx. Both variables are unsigned 8-bit integers.

If the attacker supplies a delta_idx_minus1 value that exceeds the current index, the unsigned subtraction wraps around to a large positive value. The kernel then uses this wrapped index to access the calculated_rps_st_sets[] array, reading memory far outside the intended buffer. The fix rejects control entries early when the computed reference index would underflow.

Root Cause

The root cause is missing bounds validation on attacker-controlled input before an arithmetic operation on unsigned integers. The driver trusts the delta_idx_minus1 field without verifying that the resulting reference index remains within the valid range of the RPS array.

Attack Vector

Exploitation requires local access with the ability to open the RKVDEC V4L2 m2m decoder device node, typically /dev/videoX. An attacker with permission to this device submits a crafted V4L2_CID_STATELESS_HEVC_SPS extended control containing an oversized delta_idx_minus1 value. Processing this control triggers the out-of-bounds read within the kernel decoder pipeline, leading to information disclosure or memory corruption that can be leveraged for local privilege escalation.

No exploitation code is publicly available. See the Kernel Git Commit 052c5ed5 and Kernel Git Commit 74938f83 for the upstream patches.

Detection Methods for CVE-2026-89882

Indicators of Compromise

Unexpected kernel oops or KASAN reports referencing st_ref_pic_set_prediction or calculated_rps_st_sets in dmesg output.
Unprivileged processes opening /dev/video* nodes associated with the rkvdec driver on Rockchip hardware.
Repeated V4L2 ioctl failures involving V4L2_CID_STATELESS_HEVC_SPS controls immediately preceding kernel instability.

Detection Strategies

Enable Kernel Address Sanitizer (KASAN) on test builds to catch out-of-bounds reads within the media subsystem during fuzzing.
Audit which local users and containers have access to /dev/video* device nodes on Rockchip-based systems.
Monitor kernel logs for stack traces originating from the rkvdec module or the HEVC RPS parsing path.

Monitoring Recommendations

Collect and centralize dmesg and journald kernel logs from Linux endpoints running on affected Rockchip platforms.
Alert on process executions that open V4L2 decoder devices from non-media application contexts.
Track kernel version inventory across the fleet to identify systems running unpatched builds.

How to Mitigate CVE-2026-89882

Immediate Actions Required

Apply the upstream kernel patches referenced in commit 052c5ed5 and commit 74938f83.
Restrict access to /dev/video* device nodes to trusted users and service accounts only.
Audit multi-tenant systems and container hosts on Rockchip hardware for exposure of the RKVDEC decoder.

Patch Information

The fix rejects RPS entries early when the reference index calculation would underflow. Rebuild or update to a Linux kernel that incorporates the referenced commits. Distribution vendors shipping stable kernels for Rockchip devices should backport both commits to their supported branches.

Workarounds

Unload the rkvdec kernel module on systems that do not require hardware HEVC decoding using modprobe -r rkvdec.
Tighten permissions on /dev/video* nodes through udev rules so only the video group can open the decoder.
Disable container or sandbox passthrough of V4L2 devices until the kernel is patched.

bash

# Configuration example: restrict RKVDEC device access via udev
# /etc/udev/rules.d/99-rkvdec.rules
KERNEL=="video*", SUBSYSTEM=="video4linux", DRIVERS=="rkvdec", MODE="0660", GROUP="video"

# Optionally blacklist the module until patched
echo "blacklist rkvdec" | sudo tee /etc/modprobe.d/blacklist-rkvdec.conf
sudo modprobe -r rkvdec