CVE-2026-97576 (GCVE-0-2026-97576)

Vulnerability from cvelistv5 – Published: 2026-09-25 10:21 – Updated: 2026-09-25 14:41
VLAI
Title
media: v4l2-ctrls: validate HEVC tile counts
Summary
In the Linux kernel, the following vulnerability has been resolved: media: v4l2-ctrls: validate HEVC tile counts The stateless HEVC decoders read num_tile_columns_minus1 + 1 entries from column_width_minus1[] and num_tile_rows_minus1 + 1 from row_height_minus1[] and use them as tile-loop bounds, but std_validate_compound() does not bound these u8 counts. Reject a V4L2_CTRL_TYPE_HEVC_PPS with tiling enabled whose tile counts exceed the uAPI array capacity, mirroring the existing compound-control range checks.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 256fa3920874b0f1f4cb79ad6766493a22187153 , < 400cd78a63cc647412cf069c9851bdea2818340c (git)
Affected: 256fa3920874b0f1f4cb79ad6766493a22187153 , < c7b1ef6dc57f4e57fe27cfdd3bf82033ed91ca34 (git)
Affected: 256fa3920874b0f1f4cb79ad6766493a22187153 , < ba1023d3a6d5d244d59f20c4ba6af4879ae08a9f (git)
Affected: 256fa3920874b0f1f4cb79ad6766493a22187153 , < dc694a9929f7cb9c88ef91e45eb982b7bbe5a477 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.5
Unaffected: 0 , < 5.5 (semver)
Unaffected: 6.12.111 , ≤ 6.12.* (semver)
Unaffected: 6.18.53 , ≤ 6.18.* (semver)
Unaffected: 7.2.7 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc3 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/media/v4l2-core/v4l2-ctrls-core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "400cd78a63cc647412cf069c9851bdea2818340c",
              "status": "affected",
              "version": "256fa3920874b0f1f4cb79ad6766493a22187153",
              "versionType": "git"
            },
            {
              "lessThan": "c7b1ef6dc57f4e57fe27cfdd3bf82033ed91ca34",
              "status": "affected",
              "version": "256fa3920874b0f1f4cb79ad6766493a22187153",
              "versionType": "git"
            },
            {
              "lessThan": "ba1023d3a6d5d244d59f20c4ba6af4879ae08a9f",
              "status": "affected",
              "version": "256fa3920874b0f1f4cb79ad6766493a22187153",
              "versionType": "git"
            },
            {
              "lessThan": "dc694a9929f7cb9c88ef91e45eb982b7bbe5a477",
              "status": "affected",
              "version": "256fa3920874b0f1f4cb79ad6766493a22187153",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/media/v4l2-core/v4l2-ctrls-core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.5"
            },
            {
              "lessThan": "5.5",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.111",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.53",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.111",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.53",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.7",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc3",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: v4l2-ctrls: validate HEVC tile counts\n\nThe stateless HEVC decoders read num_tile_columns_minus1 + 1 entries from\ncolumn_width_minus1[] and num_tile_rows_minus1 + 1 from row_height_minus1[]\nand use them as tile-loop bounds, but std_validate_compound() does not\nbound these u8 counts. Reject a V4L2_CTRL_TYPE_HEVC_PPS with tiling\nenabled whose tile counts exceed the uAPI array capacity, mirroring the\nexisting compound-control range checks."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The attacker-controlled bytes are num_tile_columns_minus1, num_tile_rows_minus1 and column_width_minus1[]/row_height_minus1[] in struct v4l2_ctrl_hevc_pps, copied from userspace by VIDIOC_S_EXT_CTRLS through v4l_s_ext_ctrls \u2192 v4l2_s_ext_ctrls \u2192 user_to_new into std_validate_compound(); no network protocol carries those fields.\nAC:L - Setting V4L2_HEVC_PPS_FLAG_TILES_ENABLED with num_tile_columns_minus1\u003e=20 or num_tile_rows_minus1\u003e=22 is enough; the next decode job (hantro_g2_hevc_dec_run\u2192prepare_tile_info_buffer, rkvdec assemble_hw_pps\u2192compute_tiles_non_uniform, or cedrus_h265_setup\u2192cedrus_h265_write_tiles) uses those u8 counts as loop bounds with no race or hardware-fault precondition.\nPR:L - rkvdec_open(), hantro_open() and cedrus_open() perform no capable() check; v4l2_open only requires opening the decoder /dev/videoN. On Rockchip, Allwinner and Hantro devices that node is granted to unprivileged video-group or Android media-client users, not init-namespace root.\nUI:N - The attacking process opens the HEVC decoder itself, issues VIDIOC_S_EXT_CTRLS with the crafted V4L2_CTRL_TYPE_HEVC_PPS, then QBUF/STREAMON via the request API. No separate victim mount, file-open, or playback action is required.\nS:U - The overflows remain in kernel stack (vdpu383 assemble_hw_pps column_width[22]), hantro tile_sizes DMA memory, and the rkvdec param_set PPS packet. This is kernel memory corruption under the same security authority, not a VM, IOMMU, or sandbox escape.\nC:H - cedrus_h265_write_tiles() and compute_tiles_non_uniform() index column_width_minus1[20] and row_height_minus1[22] with a u8 count up to 255, reading past the v4l2_ctrl_hevc_pps object into adjacent kernel heap that is then copied into stack and DMA tile buffers.\nI:H - compute_tiles_non_uniform() writes attacker-chosen column_width_minus1[i]+1 values past stack arrays column_width[20/22]; prepare_tile_info_buffer() writes up to 256x256 u16 pairs into a 20x22 tile_sizes DMA buffer; rkvdec_set_bw_field() stores COLUMN_WIDTH(i) past the 80-byte PPS packet.\nA:H - The stack smash of column_width/row_height, the tile_sizes DMA overflow, and rkvdec_set_bw_field() writes past param_set can walk into unmapped or poisoned memory and oops the kernel, and can wedge the HEVC decoder hardware. The trigger is repeatable at will."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-25T14:41:19.274Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/400cd78a63cc647412cf069c9851bdea2818340c"
        },
        {
          "url": "https://git.kernel.org/stable/c/c7b1ef6dc57f4e57fe27cfdd3bf82033ed91ca34"
        },
        {
          "url": "https://git.kernel.org/stable/c/ba1023d3a6d5d244d59f20c4ba6af4879ae08a9f"
        },
        {
          "url": "https://git.kernel.org/stable/c/dc694a9929f7cb9c88ef91e45eb982b7bbe5a477"
        }
      ],
      "title": "media: v4l2-ctrls: validate HEVC tile counts",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-97576",
    "datePublished": "2026-09-25T10:21:59.298Z",
    "dateReserved": "2026-09-24T16:01:01.156Z",
    "dateUpdated": "2026-09-25T14:41:19.274Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-97576",
      "date": "2026-09-28",
      "epss": "0.00163",
      "percentile": "0.04905"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-28T02:15:07.000Z",
      "cve": "CVE-2026-97576",
      "id": "msrc_CVE-2026-97576",
      "initial_release_date": "2026-09-28T02:15:07.000Z",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "media: v4l2-ctrls: validate HEVC tile counts",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-97576.json",
      "version": "1"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/media/v4l2-core/v4l2-ctrls-core.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "400cd78a63cc647412cf069c9851bdea2818340c",
                    "status": "affected",
                    "version": "256fa3920874b0f1f4cb79ad6766493a22187153",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "c7b1ef6dc57f4e57fe27cfdd3bf82033ed91ca34",
                    "status": "affected",
                    "version": "256fa3920874b0f1f4cb79ad6766493a22187153",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "ba1023d3a6d5d244d59f20c4ba6af4879ae08a9f",
                    "status": "affected",
                    "version": "256fa3920874b0f1f4cb79ad6766493a22187153",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "dc694a9929f7cb9c88ef91e45eb982b7bbe5a477",
                    "status": "affected",
                    "version": "256fa3920874b0f1f4cb79ad6766493a22187153",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/media/v4l2-core/v4l2-ctrls-core.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.5"
                  },
                  {
                    "lessThan": "5.5",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.111",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.53",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.7",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3-rc3",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: v4l2-ctrls: validate HEVC tile counts\n\nThe stateless HEVC decoders read num_tile_columns_minus1 + 1 entries from\ncolumn_width_minus1[] and num_tile_rows_minus1 + 1 from row_height_minus1[]\nand use them as tile-loop bounds, but std_validate_compound() does not\nbound these u8 counts. Reject a V4L2_CTRL_TYPE_HEVC_PPS with tiling\nenabled whose tile counts exceed the uAPI array capacity, mirroring the\nexisting compound-control range checks."
          }
        ],
        "id": "CVE-2026-97576",
        "lastModified": "2026-09-25T15:17:59.687",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-25T11:17:08.340",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/400cd78a63cc647412cf069c9851bdea2818340c"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/ba1023d3a6d5d244d59f20c4ba6af4879ae08a9f"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/c7b1ef6dc57f4e57fe27cfdd3bf82033ed91ca34"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/dc694a9929f7cb9c88ef91e45eb982b7bbe5a477"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.