CVE-2026-68206

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> media: v4l2-ctrls: validate HEVC active reference counts<br /> <br /> HEVC slice parameters are shared stateless V4L2 controls, but the common<br /> validation path does not verify the active L0/L1 reference counts before<br /> driver-specific code consumes them.<br /> <br /> The original report came from Cedrus, but the active count bounds are<br /> not Cedrus-specific. Validate them in the common HEVC slice control path<br /> so stateless HEVC drivers get the same basic guarantees as soon as the<br /> control is queued.<br /> <br /> Do not reject ref_idx_l0/ref_idx_l1 entries here. Existing userspace may<br /> use out-of-range sentinel values such as 0xff for missing references, and<br /> some hardware can use that information for concealment. Keep this common<br /> check limited to the active reference counts.