CVE-2026-97576

media: v4l2-ctrls: validate HEVC tile counts

State: Published
Severity: 7.8 High
Published: Sep 25, 2026
Updated: Oct 19, 2026
Reserved: Sep 24, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

media: v4l2-ctrls: validate HEVC tile counts

The stateless HEVC decoders read num_tile_columns_minus1 + 1 entries from column_width_minus1[] and num_tile_rows_minus1 + 1 from row_height_minus1[] and use them as tile-loop bounds, but std_validate_compound() does not bound these u8 counts. Reject a V4L2_CTRL_TYPE_HEVC_PPS with tiling enabled whose tile counts exceed the uAPI array capacity, mirroring the existing compound-control range checks.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	256fa3920874b0f1f4cb79ad6766493a22187153 to before 9c0a718e24d4cd6d975f3df9740f968f62891a20Affected 256fa3920874b0f1f4cb79ad6766493a22187153 to before 975e0180488966bb709092a52408604bd4f4edd9Affected 256fa3920874b0f1f4cb79ad6766493a22187153 to before 724915535558b14c111ad8a498b896026dfe8d20Affected 256fa3920874b0f1f4cb79ad6766493a22187153 to before 400cd78a63cc647412cf069c9851bdea2818340cAffected 256fa3920874b0f1f4cb79ad6766493a22187153 to before c7b1ef6dc57f4e57fe27cfdd3bf82033ed91ca34Affected 256fa3920874b0f1f4cb79ad6766493a22187153 to before ba1023d3a6d5d244d59f20c4ba6af4879ae08a9fAffected 256fa3920874b0f1f4cb79ad6766493a22187153 to before dc694a9929f7cb9c88ef91e45eb982b7bbe5a477Affected
LinuxLinux	5.5Affected before 5.5Not affected 5.15.222 through 5.15.Not affected 6.1.189 through 6.1.Not affected 6.6.158 through 6.6.Not affected 6.12.111 through 6.12.Not affected 6.18.53 through 6.18.Not affected 7.2.7 through 7.2.Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

256fa3920874b0f1f4cb79ad6766493a22187153 to before 9c0a718e24d4cd6d975f3df9740f968f62891a20Affected
256fa3920874b0f1f4cb79ad6766493a22187153 to before 975e0180488966bb709092a52408604bd4f4edd9Affected
256fa3920874b0f1f4cb79ad6766493a22187153 to before 724915535558b14c111ad8a498b896026dfe8d20Affected
256fa3920874b0f1f4cb79ad6766493a22187153 to before 400cd78a63cc647412cf069c9851bdea2818340cAffected
256fa3920874b0f1f4cb79ad6766493a22187153 to before c7b1ef6dc57f4e57fe27cfdd3bf82033ed91ca34Affected
256fa3920874b0f1f4cb79ad6766493a22187153 to before ba1023d3a6d5d244d59f20c4ba6af4879ae08a9fAffected
256fa3920874b0f1f4cb79ad6766493a22187153 to before dc694a9929f7cb9c88ef91e45eb982b7bbe5a477Affected

LinuxLinux

5.5Affected
before 5.5Not affected
5.15.222 through 5.15.*Not affected
6.1.189 through 6.1.*Not affected
6.6.158 through 6.6.*Not affected
6.12.111 through 6.12.*Not affected
6.18.53 through 6.18.*Not affected
7.2.7 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.