All vulnerabilities
CVE-2026-97576

Linux: media: v4l2-ctrls: validate HEVC tile counts

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
7.8High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.16%Chance of exploitation activity in the next 30 days, higher than 5% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in9c0a718e24d4cd6d975f3df9740f968f62891a20Also 975e0180488966bb709092a52408604bd4f4edd9, 724915535558b14c111ad8a498b896026dfe8d20 and 1 moreCVE List
Published25 Sep 2026Updated 19 Oct 2026CVE List

What fixes it

  • 9c0a718e24d4cd6d975f3df9740f968f62891a20LinuxCVE List
  • 975e0180488966bb709092a52408604bd4f4edd9LinuxCVE List
  • 724915535558b14c111ad8a498b896026dfe8d20LinuxCVE List
  • 400cd78a63cc647412cf069c9851bdea2818340cLinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

media: v4l2-ctrls: validate HEVC tile counts

The stateless HEVC decoders read num_tile_columns_minus1 + 1 entries from column_width_minus1[] and num_tile_rows_minus1 + 1 from row_height_minus1[] and use them as tile-loop bounds, but std_validate_compound() does not bound these u8 counts. Reject a V4L2_CTRL_TYPE_HEVC_PPS with tiling enabled whose tile counts exceed the uAPI array capacity, mirroring the existing compound-control range checks.

Text from CVE List

Affected versions 16

  • Linuxaffected: 256fa3920874b0f1f4cb79ad6766493a22187153 before 9c0a718e24d4cd6d975f3df9740f968f62891a20CVE List
  • Linuxaffected: 256fa3920874b0f1f4cb79ad6766493a22187153 before 975e0180488966bb709092a52408604bd4f4edd9CVE List
  • Linuxaffected: 256fa3920874b0f1f4cb79ad6766493a22187153 before 724915535558b14c111ad8a498b896026dfe8d20CVE List
  • Linuxaffected: 256fa3920874b0f1f4cb79ad6766493a22187153 before 400cd78a63cc647412cf069c9851bdea2818340cCVE List
  • Linuxaffected: 256fa3920874b0f1f4cb79ad6766493a22187153 before c7b1ef6dc57f4e57fe27cfdd3bf82033ed91ca34CVE List
  • Linuxaffected: 256fa3920874b0f1f4cb79ad6766493a22187153 before ba1023d3a6d5d244d59f20c4ba6af4879ae08a9fCVE List
  • Linuxaffected: 256fa3920874b0f1f4cb79ad6766493a22187153 before dc694a9929f7cb9c88ef91e45eb982b7bbe5a477CVE List
  • Linuxaffected: 5.5CVE List
  • Linuxunaffected: all versions before 5.5CVE List
  • Linuxunaffected: 5.15.222 through 5.15.*CVE List
  • Linuxunaffected: 6.1.189 through 6.1.*CVE List
  • Linuxunaffected: 6.6.158 through 6.6.*CVE List
  • Linuxunaffected: 6.12.111 through 6.12.*CVE List
  • Linuxunaffected: 6.18.53 through 6.18.*CVE List
  • Linuxunaffected: 7.2.7 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 7