CVE-2026-43222

media: verisilicon: AV1: Fix tile info buffer size

State: Published
Severity: 7.8 High
Published: May 6, 2026
Updated: Aug 5, 2026
Reserved: May 1, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

media: verisilicon: AV1: Fix tile info buffer size

Each tile info is composed of: row_sb, col_sb, start_pos and end_pos (4 bytes each). So the total required memory is AV1_MAX_TILES * 16 bytes. Use the correct #define to allocate the buffer and avoid writing tile info in non-allocated memory.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	727a400686a2c0d25015c9e44916a59b72882f83 to before a5b1ddbe31f49b4da78642157589970e9b60a231Affected 727a400686a2c0d25015c9e44916a59b72882f83 to before 34f36f9c6114af781a5a4f7a7c99334c85b73fc7Affected 727a400686a2c0d25015c9e44916a59b72882f83 to before f122f2b3ce9dbde60bf7ab0b180fe4a01f9d9bc4Affected 727a400686a2c0d25015c9e44916a59b72882f83 to before 74abfadd7ef5ac9f3a6111d550cc651d1457c641Affected 727a400686a2c0d25015c9e44916a59b72882f83 to before a505ca2db89ad92a8d8d27fa68ebafb12e04a679Affected
LinuxLinux	6.5Affected before 6.5Not affected 6.6.128 through 6.6.Not affected 6.12.75 through 6.12.Not affected 6.18.16 through 6.18.Not affected 6.19.6 through 6.19.Not affected 7.0 and laterNot affected

Product

Versions

LinuxLinux

727a400686a2c0d25015c9e44916a59b72882f83 to before a5b1ddbe31f49b4da78642157589970e9b60a231Affected
727a400686a2c0d25015c9e44916a59b72882f83 to before 34f36f9c6114af781a5a4f7a7c99334c85b73fc7Affected
727a400686a2c0d25015c9e44916a59b72882f83 to before f122f2b3ce9dbde60bf7ab0b180fe4a01f9d9bc4Affected
727a400686a2c0d25015c9e44916a59b72882f83 to before 74abfadd7ef5ac9f3a6111d550cc651d1457c641Affected
727a400686a2c0d25015c9e44916a59b72882f83 to before a505ca2db89ad92a8d8d27fa68ebafb12e04a679Affected

LinuxLinux

6.5Affected
before 6.5Not affected
6.6.128 through 6.6.*Not affected
6.12.75 through 6.12.*Not affected
6.18.16 through 6.18.*Not affected
6.19.6 through 6.19.*Not affected
7.0 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.