{"id":"CVE-2026-98882","kind":"vulnerability","aliases":["CVE-2026-98882"],"related":[],"title":"Linux kernel: wave5 media decoder missing range check allows out-of-bounds write","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: chips-media: wave5: Add range checks for dec_output_info\n\nIf the driver's dec_output_info contains invalid data the driver can\nwrite in invalid memory. Add a range check for that.\n\nThis fixes this smatch error:\ndrivers/media/platform/chips-media/wave5/wave5-vpuapi.c:588 wave5_vpu_dec_get_output_info() error: buffer overflow 'inst->frame_buf' 64 <= 127","summary":"The Linux kernel's chips-media wave5 video decoder driver trusts invalid output information from the hardware, which can make it write outside a frame buffer array. The sources describe a kernel memory write, with no stated attacker-controlled path or impact beyond that.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["arm-boards","chips-media-wave5","embedded","infrastructure","linux-kernel"],"not_affected_if":["driver-not-loaded","no-wave5-hardware"],"how_to_check":"- `uname -r` to see the running kernel version\n- `lsmod | grep wave5` to check whether the wave5 driver is loaded\n- unknown whether a specific kernel version is fixed; the sources do not list affected or fixed versions","fix":"- Update the Linux kernel to a release that includes the upstream commit adding range checks in wave5-vpuapi.c; fixed version numbers: unknown\n- Check your distribution's kernel advisory for the patched package","status":"open","published_at":"2026-10-23T12:18:21+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","triaged_at":"2026-10-25T05:00:09+00:00","updated_at":"2026-10-25T05:00:09+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-25T05:00:09Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream commit adding range checks in wave5-vpuapi.c; fixed version numbers: unknown\n- Check your distribution's kernel advisory for the patched package","reach":"local","title":"Linux kernel: wave5 media decoder missing range check allows out-of-bounds write","impact":"medium","summary":"The Linux kernel's chips-media wave5 video decoder driver trusts invalid output information from the hardware, which can make it write outside a frame buffer array. The sources describe a kernel memory write, with no stated attacker-controlled path or impact beyond that.","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","embedded","arm-boards","chips-media-wave5"],"confidence":0.5,"needs_auth":"unknown","worst_case":"kernel memory corruption from invalid hardware output data","analyst_note":"Check the NVD entry and the upstream kernel commit for affected version ranges and whether an unprivileged user can trigger the decoder path.","how_to_check":"- `uname -r` to see the running kernel version\n- `lsmod | grep wave5` to check whether the wave5 driver is loaded\n- unknown whether a specific kernel version is fixed; the sources do not list affected or fixed versions","needs_analyst":true,"not_affected_if":["no-wave5-hardware","driver-not-loaded"],"who_is_affected":"Systems running a Linux kernel with the chips-media wave5 video decoder driver, which is used by certain Chips&Media VPU hardware in embedded and ARM boards. Systems without that hardware or without the driver loaded are unlikely to be exposed. The sources do not say how an attacker would reach the driver.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000657,"input_tokens":3384,"output_tokens":637,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':16A,19A '-98882':17A,20A '127':143C '588':129C '64':142C 'add':93C,117C 'allow':9A 'arm':22B 'arm-board':21B 'array':60B 'attack':72B 'attacker-control':71B 'beyond':77B 'board':23B 'bound':13A 'buf':141C 'buffer':59B,137C 'check':8A,95C,120C 'chip':25B,38B,90C 'chips-media':37B,89C 'chips-media-wave5':24B 'contain':107C 'control':73B 'cve':15A,18A 'data':109C 'dec':97C,104C,132C 'decod':5A,42B 'describ':63B 'driver':43B,102C,111C 'drivers/media/platform/chips-media/wave5/wave5-vpuapi.c':128C 'embed':28B 'error':127C,136C 'fix':124C 'follow':83C 'frame':58B,140C 'get':133C 'hardwar':50B 'impact':76B 'info':99C,106C,135C 'inform':47B 'infrastructur':29B 'inst':139C 'invalid':45B,108C,115C 'kernel':2A,32B,35B,65B,81C 'linux':1A,31B,34B,80C 'linux-kernel':30B 'make':53B 'media':4A,26B,39B,88C,91C 'memori':66B,116C 'miss':6A 'out-of-bound':10A 'output':46B,98C,105C,134C 'outsid':56B 'overflow':138C 'path':74B 'rang':7A,94C,119C 'resolv':87C 'smatch':126C 'sourc':62B 'state':70B 'trust':44B 'video':41B 'vpu':131C 'vulner':84C 'wave5':3A,27B,40B,92C,130C 'write':14A,55B,67B,113C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with the chips-media wave5 video decoder driver, which is used by certain Chips&Media VPU hardware in embedded and ARM boards. Systems without that hardware or without the driver loaded are unlikely to be exposed. The sources do not say how an attacker would reach the driver.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T12:18:21+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98882","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98882","severity":null,"published_at":"2026-10-23T12:18:21+00:00","modified_at":"2026-10-23T12:18:21+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}