CVE-2026-68229

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> media: cedrus: skip invalid H.264 reference list entries<br /> <br /> Cedrus consumes H.264 ref_pic_list0/ref_pic_list1 entries from the<br /> stateless slice control and later uses their indices to look up<br /> decode-&gt;dpb[] in _cedrus_write_ref_list().<br /> <br /> Rejecting such controls in cedrus_try_ctrl() would break existing<br /> userspace, since stateless H.264 reference lists may legitimately carry<br /> out-of-range indices for missing references. Instead, guard the actual<br /> DPB lookup in Cedrus and skip entries whose indices do not fit the fixed<br /> V4L2_H264_NUM_DPB_ENTRIES array.<br /> <br /> This keeps the fix local to the driver use site and avoids out-of-bounds<br /> reads from malformed or unsupported reference list entries.