https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 05:35:24 +0000 https://vulnerability.circl.lu/vuln/cve-2026-68229 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>media: cedrus: skip invalid H.264 reference list entries</p> <p>Cedrus consumes H.264 ref_pic_list0/ref_pic_list1 entries from the stateless slice control and later uses their indices to look up decode-&gt;dpb[] in _cedrus_write_ref_list().</p> <p>Rejecting such controls in cedrus_try_ctrl() would break existing userspace, since stateless H.264 reference lists may legitimately carry out-of-range indices for missing references. Instead, guard the actual DPB lookup in Cedrus and skip entries whose indices do not fit the fixed V4L2_H264_NUM_DPB_ENTRIES array.</p> <p>This keeps the fix local to the driver use site and avoids out-of-bounds reads from malformed or unsupported reference list entries.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>media: cedrus: skip invalid H.264 reference list entries</p> <p>Cedrus consumes H.264 ref_pic_list0/ref_pic_list1 entries from the stateless slice control and later uses their indices to look up decode-&gt;dpb[] in _cedrus_write_ref_list().</p> <p>Rejecting such controls in cedrus_try_ctrl() would break existing userspace, since stateless H.264 reference lists may legitimately carry out-of-range indices for missing references. Instead, guard the actual DPB lookup in Cedrus and skip entries whose indices do not fit the fixed V4L2_H264_NUM_DPB_ENTRIES array.</p> <p>This keeps the fix local to the driver use site and avoids out-of-bounds reads from malformed or unsupported reference list entries.</p> https://vulnerability.circl.lu/vuln/cve-2026-68229