CVE-2026-97581

media: verisilicon: hantro: bound G2 HEVC tile loop to the buffer capacity

State: Published
Severity: Not scored
Published: Sep 25, 2026
Updated: Oct 19, 2026
Reserved: Sep 24, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

media: verisilicon: hantro: bound G2 HEVC tile loop to the buffer capacity

prepare_tile_info_buffer() writes one entry per tile into the tile_sizes DMA buffer, sized for a grid equal to the PPS uAPI array capacity. Use the bounded v4l2_hevc_pps_num_tile_columns() / v4l2_hevc_pps_num_tile_rows() helpers so the loops stay inside the buffer.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	cb5dd5a0fa518dff14ff2b90837c3c8f98f4dd5c to before 6d192fc0d6faff25ecf6d52cbde4b939cb12c192Affected cb5dd5a0fa518dff14ff2b90837c3c8f98f4dd5c to before 2887a98c03d97a6fcb6c2dab92956f2f4c402cddAffected cb5dd5a0fa518dff14ff2b90837c3c8f98f4dd5c to before 62ae24639d22909a5724627a0467e4bde9704020Affected cb5dd5a0fa518dff14ff2b90837c3c8f98f4dd5c to before 4f654c9bc954569ff9b8ab860b29480c4cf6f57bAffected cb5dd5a0fa518dff14ff2b90837c3c8f98f4dd5c to before 05e8e4cdfe692f5cedba9aa9d7b8f2584cf926c8Affected cb5dd5a0fa518dff14ff2b90837c3c8f98f4dd5c to before 06236b094c899c22c12ac5097935eb6719293de8Affected
LinuxLinux	5.14Affected before 5.14Not affected 6.1.189 through 6.1.Not affected 6.6.158 through 6.6.Not affected 6.12.111 through 6.12.Not affected 6.18.53 through 6.18.Not affected 7.2.7 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

cb5dd5a0fa518dff14ff2b90837c3c8f98f4dd5c to before 6d192fc0d6faff25ecf6d52cbde4b939cb12c192Affected
cb5dd5a0fa518dff14ff2b90837c3c8f98f4dd5c to before 2887a98c03d97a6fcb6c2dab92956f2f4c402cddAffected
cb5dd5a0fa518dff14ff2b90837c3c8f98f4dd5c to before 62ae24639d22909a5724627a0467e4bde9704020Affected
cb5dd5a0fa518dff14ff2b90837c3c8f98f4dd5c to before 4f654c9bc954569ff9b8ab860b29480c4cf6f57bAffected
cb5dd5a0fa518dff14ff2b90837c3c8f98f4dd5c to before 05e8e4cdfe692f5cedba9aa9d7b8f2584cf926c8Affected
cb5dd5a0fa518dff14ff2b90837c3c8f98f4dd5c to before 06236b094c899c22c12ac5097935eb6719293de8Affected

LinuxLinux

5.14Affected
before 5.14Not affected
6.1.189 through 6.1.*Not affected
6.6.158 through 6.6.*Not affected
6.12.111 through 6.12.*Not affected
6.18.53 through 6.18.*Not affected
7.2.7 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.