CVE-2026-89724

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

media: vicodec: fix out-of-bounds write in FWHT encoder

vidioc_s_fmt_vid_out() sizes the encoder CAPTURE buffer from the

compressed descriptor pixfmt_fwht, whose sizeimage_mult is 3:

coded_w * coded_h * 3 + sizeof(struct fwht_cframe_hdr). fwht_encode_frame()

encodes one plane per component, and an incompressible plane takes the

FWHT_FRAME_UNENCODED path in encode_plane(), copying the plane verbatim.

For a 4-component pixel format all four planes are full resolution

(width_div == height_div == 1), so a frame that forces every plane

through the unencoded fallback writes

sizeof(struct fwht_cframe_hdr) + 4 * coded_w * coded_h bytes, overrunning

the plane by coded_w * coded_h, which can result in corruption

of adjacent kernel heap memory.

Bump pixfmt_fwht.sizeimage_mult from 3 to 4, matching the largest

components_num among the supported raw formats, so the capture buffer is

always large enough for the unencoded fallbac

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References