All vulnerabilities
CVE-2026-97575

Linux: media: v4l2-ctrls: validate AV1 tile counts

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
7.8High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.16%Chance of exploitation activity in the next 30 days, higher than 5% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in1afaf85c4990fb1e3168d0d6e99246a65e526f1bAlso 85df9fc79b07f1cc7c953f930ae7e675d0c1e820, 439058ced617fbb3febc017b9e93bb7387f309e0CVE List
Published25 Sep 2026Updated 19 Oct 2026CVE List

What fixes it

  • 1afaf85c4990fb1e3168d0d6e99246a65e526f1bLinuxCVE List
  • 85df9fc79b07f1cc7c953f930ae7e675d0c1e820LinuxCVE List
  • 439058ced617fbb3febc017b9e93bb7387f309e0LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

media: v4l2-ctrls: validate AV1 tile counts

The stateless AV1 decoders use tile_info.tile_cols and tile_rows as loop bounds and as indices into the mi_*_starts[] and *_in_sbs_minus_1[] arrays, as the divisor for context_update_tile_id, and their product bounds the per-tile descriptor buffers, but std_validate_compound() does not bound these u8 fields. Reject a V4L2_CTRL_TYPE_AV1_FRAME whose tile_cols or tile_rows exceeds V4L2_AV1_MAX_TILE_COLS / _ROWS, or whose product exceeds V4L2_AV1_MAX_TILE_COUNT. A zero tile count is left to the consuming driver so the zero-initialised control that existing userspace submits is still accepted.

Text from CVE List

Affected versions 12

  • Linuxaffected: 9de30f579980b498606a9c2440b73ae3b670771b before 1afaf85c4990fb1e3168d0d6e99246a65e526f1bCVE List
  • Linuxaffected: 9de30f579980b498606a9c2440b73ae3b670771b before 85df9fc79b07f1cc7c953f930ae7e675d0c1e820CVE List
  • Linuxaffected: 9de30f579980b498606a9c2440b73ae3b670771b before c8891da0186fe4c04bccbbd7d84b01a3c941ac7aCVE List
  • Linuxaffected: 9de30f579980b498606a9c2440b73ae3b670771b before c4c88b5ba85685043d171e0e9c9d00a8cf6a89e8CVE List
  • Linuxaffected: 9de30f579980b498606a9c2440b73ae3b670771b before 439058ced617fbb3febc017b9e93bb7387f309e0CVE List
  • Linuxaffected: 6.5CVE List
  • Linuxunaffected: all versions before 6.5CVE List
  • Linuxunaffected: 6.6.158 through 6.6.*CVE List
  • Linuxunaffected: 6.12.111 through 6.12.*CVE List
  • Linuxunaffected: 6.18.53 through 6.18.*CVE List
  • Linuxunaffected: 7.2.7 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 5