{"schema":"threatline.record/2","record":{"id":"CVE-2026-97575","aliases":[],"summary":"media: v4l2-ctrls: validate AV1 tile counts","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: v4l2-ctrls: validate AV1 tile counts\n\nThe stateless AV1 decoders use tile_info.tile_cols and tile_rows as loop\nbounds and as indices into the mi_*_starts[] and *_in_sbs_minus_1[]\narrays, as the divisor for context_update_tile_id, and their product\nbounds the per-tile descriptor buffers, but std_validate_compound() does\nnot bound these u8 fields. Reject a V4L2_CTRL_TYPE_AV1_FRAME whose\ntile_cols or tile_rows exceeds V4L2_AV1_MAX_TILE_COLS / _ROWS, or whose\nproduct exceeds V4L2_AV1_MAX_TILE_COUNT. A zero tile count is left to the\nconsuming driver so the zero-initialised control that existing userspace\nsubmits is still accepted.","categories":["Operating systems"],"product":"Linux","vendor":"Linux","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-97575","source_modified_at":"2026-10-19T09:09:37.843Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"Linux","vendor":"Linux","versions":[{"version":"9de30f579980b498606a9c2440b73ae3b670771b","lessThan":"1afaf85c4990fb1e3168d0d6e99246a65e526f1b","status":"affected","versionType":"git"},{"version":"9de30f579980b498606a9c2440b73ae3b670771b","lessThan":"85df9fc79b07f1cc7c953f930ae7e675d0c1e820","status":"affected","versionType":"git"},{"version":"9de30f579980b498606a9c2440b73ae3b670771b","lessThan":"c8891da0186fe4c04bccbbd7d84b01a3c941ac7a","status":"affected","versionType":"git"},{"version":"9de30f579980b498606a9c2440b73ae3b670771b","lessThan":"c4c88b5ba85685043d171e0e9c9d00a8cf6a89e8","status":"affected","versionType":"git"},{"version":"9de30f579980b498606a9c2440b73ae3b670771b","lessThan":"439058ced617fbb3febc017b9e93bb7387f309e0","status":"affected","versionType":"git"}],"defaultStatus":"unaffected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-97575","source_modified_at":"2026-10-19T09:09:37.843Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"Linux","vendor":"Linux","versions":[{"version":"6.5","status":"affected"},{"version":"0","lessThan":"6.5","status":"unaffected","versionType":"semver"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","status":"unaffected","versionType":"semver"},{"version":"7.3","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}],"defaultStatus":"affected"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-97575","source_modified_at":"2026-10-19T09:09:37.843Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"Linux","ecosystem":null},"version":"1afaf85c4990fb1e3168d0d6e99246a65e526f1b","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-97575","source_modified_at":"2026-10-19T09:09:37.843Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"Linux","ecosystem":null},"version":"85df9fc79b07f1cc7c953f930ae7e675d0c1e820","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-97575","source_modified_at":"2026-10-19T09:09:37.843Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"Linux","ecosystem":null},"version":"439058ced617fbb3febc017b9e93bb7387f309e0","basis":"first unaffected version stated in the CVE record"}],"cvss":7.8,"severity":"High","kev":{"listed":false},"epss":{"probability":0.00163,"percentile":0.05237,"score_date":"2026-10-23"},"published_at":"2026-09-25T10:21:58.700Z","modified_at":"2026-10-19T09:09:37.843Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-97575","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-10-19T09:09:37.843Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-97575","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://git.kernel.org/stable/c/1afaf85c4990fb1e3168d0d6e99246a65e526f1b"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/85df9fc79b07f1cc7c953f930ae7e675d0c1e820"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/c8891da0186fe4c04bccbbd7d84b01a3c941ac7a"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/c4c88b5ba85685043d171e0e9c9d00a8cf6a89e8"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/439058ced617fbb3febc017b9e93bb7387f309e0"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"product","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-19T09:09:37.843Z","content_hash":"22ade2d1f11b4283e449219d281dc0e084440cb6bb5dada38c8cfc742f25fc26"}}