CVE-2026-68206

A flaw was found in the Linux kernel's V4L2 controls for High Efficiency Video Coding (HEVC). The common validation path for HEVC slice parameters does not properly verify the active L0/L1 reference counts before driver-specific code processes them. This lack of validation could allow a local user or application to provide malformed HEVC slice parameters, potentially leading to unexpected behavior or system instability.

This vulnerability is rated as Moderate impact for Red Hat Enterprise Linux because exploitation requires local access and is limited to causing system instability or denial of service. Triggering this flaw requires access to Video4Linux2 device nodes backed by hardware drivers supporting stateless High Efficiency Video Coding (HEVC) controls. Standard enterprise deployments rarely expose such specialized video decoding hardware to unprivileged users, significantly mitigating practical exposure.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.