CVE-2026-89724

In the Linux kernel, the following vulnerability has been resolved:

media: vicodec: fix out-of-bounds write in FWHT encoder

vidioc_s_fmt_vid_out() sizes the encoder CAPTURE buffer from the

compressed descriptor pixfmt_fwht, whose sizeimage_mult is 3:

coded_w * coded_h * 3 + sizeof(struct fwht_cframe_hdr). fwht_encode_frame()

encodes one plane per component, and an incompressible plane takes the

FWHT_FRAME_UNENCODED path in encode_plane(), copying the plane verbatim.

For a 4-component pixel format all four planes are full resolution

(width_div == height_div == 1), so a frame that forces every plane

through the unencoded fallback writes

sizeof(struct fwht_cframe_hdr) + 4 * coded_w * coded_h bytes, overrunning

the plane by coded_w * coded_h, which can result in corruption

of adjacent kernel heap memory.

Bump pixfmt_fwht.sizeimage_mult from 3 to 4, matching the largest

components_num among the supported raw formats, so the capture buffer is

always large enough for the unencoded fallback.