CVE-2026-68206

CVE-2026-68206 reveals a gap in the V4L2 stateless codec control validation path that affects the entire ecosystem of HEVC decoders, not a single driver. The vulnerability exists in the shared code that processes HEVC control structures before dispatching to driver-specific handlers — specifically, the active reference count fields in the L0 and L1 reference picture lists were never bounds-checked at the common validation layer. Any userspace application passing untrusted HEVC bitstreams through V4L2 stateless controls triggers this path, meaning exploitation doesn't require targeting a particular driver's implementation. The fix validates the active count values while explicitly preserving 0xff sentinel values in the ref_idx_l0 and ref_idx_l1 fields. This preservation is not a bug — some hardware uses 0xff for error concealment, and userspace has come to rely on it. The kernel had to close the dangerous path (unbounded active counts that could corrupt memory) without breaking a legitimate hardware behavior that predates this fix. That backward-compatibility constraint is what makes input validation in media drivers structurally harder than in most kernel subsystems: you're often validating against undocumented hardware quirks rather than specdefined behavior. The severity (CVSS 7.8) reflects the privilege escalation potential from a media processing context, but the EPSS score of 0.00209 captures current exploitability, not architectural trajectory. Stateless codec architectures are expanding in mobile and embedded devices precisely because they shift complexity to software — meaning more HEVC streams pass through V4L2 controls on more devices. The shared validation path that made this CVE possible is the same pattern that existed for VP8 and H.264 before similar fixes landed. The real question is whether the V4L2 validation architecture now has an explicit ownership model — someone formally responsible for bounds-checking stateless codec controls at the common layer before any driver-specific logic runs. Without that governance structure, each new stateless codec addition inherits the same risk, and the next CVE in this series is a matter of when, not if.

Reviewed through automated stages and approved by a human before publication.