CVE-2026-89882

CVE-2026-89882 is an out-of-bounds read in the Linux kernel's RKVDEC HEVC video decoder (media: rkvdec: hevc). The function st_ref_pic_set_prediction() computes a reference RPS index using two u8 operands; when delta_idx_minus1 + 1 exceeds the current index, the subtraction underflows , causing a...