CVE-2026-89873 media: v4l2-ctrls: validate HEVC EXT SPS RPS counts
An attacker can cause a denial of service in the Linux kernel by providing invalid HEVC SPS RPS counts that bypass validation checks.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-89873?
CVE-2026-89873 is a high-severity vulnerability in Linux, published on 16 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
media: v4l2-ctrls: validate HEVC EXT SPS RPS counts
The HEVC SPS control carries the short-term and long-term RPS counts that decoder drivers use to walk the matching EXT SPS dynamic arrays. Reject SPS values that exceed the HEVC limits of 64 short-term sets and 32 long-term references so drivers cannot later index beyond those controls.
Also reject EXT SPS ST RPS entries whose negative or positive picture counts exceed the 16-entry arrays, or whose combined delta-POC count exceeds the HEVC DPB maximum.
Which versions are affected by CVE-2026-89873?
How do I fix CVE-2026-89873?
Apply the vendor's patch.
Is CVE-2026-89873 being exploited?
There is no known exploitation of CVE-2026-89873 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-89873, GHSA-p727-h8jp-cv82, UBUNTU-CVE-2026-89873.