{"cve":"CVE-2026-98882","nvd":{"published":"2026-10-23T12:18:21.823","modified":"2026-10-26T07:17:13.127","status":"Received","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: chips-media: wave5: Add range checks for dec_output_info\n\nIf the driver's dec_output_info contains invalid data the driver can\nwrite in invalid memory. Add a range check for that.\n\nThis fixes this smatch error:\ndrivers/media/platform/chips-media/wave5/wave5-vpuapi.c:588 wave5_vpu_dec_get_output_info() error: buffer overflow 'inst->frame_buf' 64 <= 127","cvss_v4":null,"cvss_v3":null,"cwes":[],"references":["https://git.kernel.org/stable/c/144f24ec0fc1e51673611912a6d14ded0a61db43","https://git.kernel.org/stable/c/79aef69bb0903616f4867f0168aea717a11c439c","https://git.kernel.org/stable/c/d6f777d11c7b34549cdadd8578d4b85f685eb976"],"products":[],"source":"nvd","synced_at":"2026-10-26T07:33:01.631659812+00:00"},"epss":{"cve":"CVE-2026-98882","score":0.0019,"percentile":0.08563,"date":"2026-10-25"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}