---
id: CVE-2026-89724
title: 'media: vicodec: fix out-of-bounds write in FWHT encoder'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  media: vicodec: fix out-of-bounds write in FWHT encoder

  vidioc_s_fmt_vid_out() sizes the encoder CAPTURE buffer from the
  compressed descriptor pixfmt_fwht, whose sizei…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-787
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 16ecf6dff97ce0194a7126e26159492668d47a7e <
    f7ae26c100a6c26c2a166d2c41e73188067b36bd
  - >-
    Linux >= 16ecf6dff97ce0194a7126e26159492668d47a7e <
    6ea647e76c44387d5c1c635df4604c2154d9060e
  - >-
    Linux >= 16ecf6dff97ce0194a7126e26159492668d47a7e <
    d40838a63f2bd6a3df0a6cdd8ff1d5c6366e8fff
  - >-
    Linux >= 16ecf6dff97ce0194a7126e26159492668d47a7e <
    e21cccc29b840930cd9dcfdf1139658063a681af
  - >-
    Linux >= 16ecf6dff97ce0194a7126e26159492668d47a7e <
    84cfebf7f4229d748cca8eb9c4e1f1c4099d3ab7
  - >-
    Linux >= 16ecf6dff97ce0194a7126e26159492668d47a7e <
    8c14472431e27f13661d0db9d837156eaced0ecb
  - >-
    Linux >= 16ecf6dff97ce0194a7126e26159492668d47a7e <
    b95315ffc66b39856396c1043618bb4e4d5785ba
  - >-
    Linux >= 16ecf6dff97ce0194a7126e26159492668d47a7e <
    cf4500ebf6fb57bf4ab83c3dd349a40257dbe2a9
  - Linux 5.0
published: '2026-09-11'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T08:51:37.470Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-89724'
references:
  - url: 'https://git.kernel.org/stable/c/f7ae26c100a6c26c2a166d2c41e73188067b36bd'
  - url: 'https://git.kernel.org/stable/c/6ea647e76c44387d5c1c635df4604c2154d9060e'
  - url: 'https://git.kernel.org/stable/c/d40838a63f2bd6a3df0a6cdd8ff1d5c6366e8fff'
  - url: 'https://git.kernel.org/stable/c/e21cccc29b840930cd9dcfdf1139658063a681af'
  - url: 'https://git.kernel.org/stable/c/84cfebf7f4229d748cca8eb9c4e1f1c4099d3ab7'
  - url: 'https://git.kernel.org/stable/c/8c14472431e27f13661d0db9d837156eaced0ecb'
  - url: 'https://git.kernel.org/stable/c/b95315ffc66b39856396c1043618bb4e4d5785ba'
  - url: 'https://git.kernel.org/stable/c/cf4500ebf6fb57bf4ab83c3dd349a40257dbe2a9'
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89724.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-89724'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2532428'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-89724'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-89724'
  - url: >-
      https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89724.mbox
tags:
  - cve.org
  - csaf
  - vex
  - red-hat
  - score-dispute
epss: 0.00169
epssPercentile: 0.06192
scores:
  cna: 7.8
  vendor: 5.5
ingestedAt: '2026-09-14T15:23:07.449Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

media: vicodec: fix out-of-bounds write in FWHT encoder

vidioc_s_fmt_vid_out() sizes the encoder CAPTURE buffer from the
compressed descriptor pixfmt_fwht, whose sizeimage_mult is 3:
coded_w * coded_h * 3 + sizeof(struct fwht_cframe_hdr). fwht_encode_frame()
encodes one plane per component, and an incompressible plane takes the
FWHT_FRAME_UNENCODED path in encode_plane(), copying the plane verbatim.

For a 4-component pixel format all four planes are full resolution
(width_div == height_div == 1), so a frame that forces every plane
through the unencoded fallback writes
sizeof(struct fwht_cframe_hdr) + 4 * coded_w * coded_h bytes, overrunning
the plane by coded_w * coded_h, which can result in corruption
of adjacent kernel heap memory.

Bump pixfmt_fwht.sizeimage_mult from 3 to 4, matching the largest
components_num among the supported raw formats, so the capture buffer is
always large enough for the unencoded fallback.

## Affected

- `Linux >= 16ecf6dff97ce0194a7126e26159492668d47a7e < f7ae26c100a6c26c2a166d2c41e73188067b36bd`
- `Linux >= 16ecf6dff97ce0194a7126e26159492668d47a7e < 6ea647e76c44387d5c1c635df4604c2154d9060e`
- `Linux >= 16ecf6dff97ce0194a7126e26159492668d47a7e < d40838a63f2bd6a3df0a6cdd8ff1d5c6366e8fff`
- `Linux >= 16ecf6dff97ce0194a7126e26159492668d47a7e < e21cccc29b840930cd9dcfdf1139658063a681af`
- `Linux >= 16ecf6dff97ce0194a7126e26159492668d47a7e < 84cfebf7f4229d748cca8eb9c4e1f1c4099d3ab7`
- `Linux >= 16ecf6dff97ce0194a7126e26159492668d47a7e < 8c14472431e27f13661d0db9d837156eaced0ecb`
- `Linux >= 16ecf6dff97ce0194a7126e26159492668d47a7e < b95315ffc66b39856396c1043618bb4e4d5785ba`
- `Linux >= 16ecf6dff97ce0194a7126e26159492668d47a7e < cf4500ebf6fb57bf4ab83c3dd349a40257dbe2a9`
- `Linux 5.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Moderate · updated 2026-09-15 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89724.json)