CVE-2026-89885

CVE-2026-89885 is a use-after-free vulnerability in the Linux kernel 's mtk-mdp3 media platform driver. In mdp_probe(), when the primary scp_get() call fails, the fallback path retrieves the SCP platform device via __get_pdev_by_id() but immediately drops the reference after reading driver data. ...

CVE-2026-89884

CVE-2026-89884 affects the mtk-mdp3 platform driver in the Linux kernel (MediaTek multimedia display processor). The vulnerability is a NULL pointer dereference that occurs when the driver looks up the SCP (System Control Processor) but the SCP driver has not yet been bound, causing the lookup to...

CVE-2026-89883

This vulnerability affects the Linux kernel 's sunxi-cir infrared remote control driver (used in Allwinner/Sunxi SoCs). The root cause is an improper error-handling path: after rc_register_device() succeeds, subsequent probe failures (IRQ lookup, IRQ request, or hardware initialization) jump to a...

CVE-2026-89882

CVE-2026-89882 is an out-of-bounds read in the Linux kernel's RKVDEC HEVC video decoder (media: rkvdec: hevc). The function st_ref_pic_set_prediction() computes a reference RPS index using two u8 operands; when delta_idx_minus1 + 1 exceeds the current index, the subtraction underflows , causing a...

CVE-2026-89880

CVE-2026-89880 affects the Linux kernel rtl2832_sdr media driver (Realtek RTL2832 USB SDR radio). The root cause is a missing teardown on the error path of rtl2832_sdr_start_streaming(): when URB submission or allocation fails after stream buffers are allocated, the URBs and coherent DMA buffers ...

CVE-2026-89881

This CVE affects the rtl2832_sdr media driver in the Linux kernel . On USB disconnect, rtl2832_sdr_remove() clears dev->udev to NULL before any pending streaming teardown has completed. When user space subsequently closes its file descriptor, usb_free_coherent() is invoked with a NULL device p...

CVE-2026-89879

This Linux kernel vulnerability affects the s2255 media driver. In s2255_fillbuff(), a memcpy() copies vc->jpg_size bytes of a captured JPEG/MJPEG frame into a vb2 plane, but the size value is taken verbatim from the device's S2255_MARKER_FRAME header without being bounded against the destinat...

CVE-2026-89878

CVE-2026-89878 affects the Linux kernel media: s2255 driver. In s2255_probe(), the function reads a 4-byte marker and version from the last 8 bytes of the firmware blob (fw->data[fw_size - 8] and [fw_size - 4]). If the firmware file is shorter than 8 bytes, fw_size - 8 underflows , causing an ...

CVE-2026-89877

CVE-2026-89877 affects the saa7164 media driver in the Linux kernel . The root cause is a cleanup bug in saa7164_dev_setup(): the device is added to the global saa7164_devlist before PCI BAR memory regions are requested. If get_resources() fails, the device remains on the list while the probe err...

CVE-2026-89876

CVE-2026-89876 affects the tda18250 driver in the Linux kernel's media subsystem. The vulnerability is a possible integer overflow that occurs when the variable exp equals zero, causing the expression 1 <

CVE-2026-89875

This is a use-after-free vulnerability in the Linux kernel's Texas Instruments VIP (Video Imaging Processors) driver, specifically the vpe media subsystem. The root cause is that vip_stop_streaming() masks and clears per-list IRQs but does not synchronize the hardirq handler or disable the recove...

CVE-2026-89874

CVE-2026-89874 affects the Linux kernel media subsystem (v4l2-async). The vulnerability is a NULL pointer dereference in v4l2_async_match_notify(): when ancillary media link creation fails, the function jumps to err_call_unbind before asc_subdev_entry is inserted into sd->asc_list. Because asy...

CVE-2026-89873

CVE-2026-89873 affects the Linux kernel 's media: v4l2-ctrls subsystem, which handles HEVC video decoding controls. The vulnerability is a missing input validation on the HEVC Sequence Parameter Set (SPS) Reference Picture Set (RPS) counts. Specifically, SPS values exceeding the HEVC limits of 64...

CVE-2026-89872

CVE-2026-89872 affects the Linux kernel in the v4l2-fwnode media subsystem. The root cause is a fwnode reference leak in v4l2_fwnode_parse_link(): the remote endpoint fwnode handle acquired via fwnode_graph_get_remote_endpoint() is properly released on error paths but is not released on the succe...

CVE-2026-89870

CVE-2026-89870 is a double-free vulnerability in the Linux kernel 's zoran media driver. During device teardown, zoran_exit_video_devices() called video_unregister_device() (which eventually triggers the V4L2 core's release callback to free the video_device) and then explicitly called kfree(zr-&g...

CVE-2026-89871

CVE-2026-89871 affects the Linux kernel in the media: video-i2c subsystem. The root cause is that kthread_run() returns an ERR_PTR on failure (not NULL), and when start_streaming() fails, the data->kthread_vid_cap field is left holding this error pointer instead of being reset. This leads to t...

CVE-2026-89869

The Linux kernel's qcom iris media driver has a race condition in the VPU power-off path. The function iris_vpu_power_off() used disable_irq_nosync(), which does not wait for an already-queued threaded IRQ handler to finish. As a result, a threaded IRQ handler could still execute after the VPU ha...

CVE-2026-89868

This CVE affects the Linux kernel 's chips-media: wave5 VPU decoder driver. The root cause is a potential infinite loop in the stop_streaming function, which can occur when the driver attempts to stop a video decoding stream. The fix introduces a bounded poll of the queue status: the driver now l...

CVE-2026-89867

CVE-2026-89867 affects the Linux kernel chips-media wave5 VPU driver in the media subsystem. Decoder instances sharing a VPU also share a single v4l2_m2m job slot . During end-of-stream (EOS), device_run() defers job_finish() expecting a DEC_PIC completion IRQ to release the slot. However, a job ...

CVE-2026-89866

This vulnerability affects the chips-media wave5 VPU driver in the Linux kernel . When the End-of-Stream (EOS) flag is set via send_firmware_command(), it accesses VPU registers that may be powered down if the device is in a runtime-suspended state. Both the STREAMOFF path (wave5_vpu_dec_job_abor...