All vulnerabilities
CVE-2026-97581

Linux: media: verisilicon: hantro: bound G2 HEVC tile loop to the buffer capacity

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.21%Chance of exploitation activity in the next 30 days, higher than 10% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in6d192fc0d6faff25ecf6d52cbde4b939cb12c192Also 2887a98c03d97a6fcb6c2dab92956f2f4c402cdd, 62ae24639d22909a5724627a0467e4bde9704020 and 3 moreCVE List
Published25 Sep 2026Updated 19 Oct 2026CVE List

What fixes it

  • 6d192fc0d6faff25ecf6d52cbde4b939cb12c192LinuxCVE List
  • 2887a98c03d97a6fcb6c2dab92956f2f4c402cddLinuxCVE List
  • 62ae24639d22909a5724627a0467e4bde9704020LinuxCVE List
  • 4f654c9bc954569ff9b8ab860b29480c4cf6f57bLinuxCVE List
  • 05e8e4cdfe692f5cedba9aa9d7b8f2584cf926c8LinuxCVE List
  • 06236b094c899c22c12ac5097935eb6719293de8LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

media: verisilicon: hantro: bound G2 HEVC tile loop to the buffer capacity

prepare_tile_info_buffer() writes one entry per tile into the tile_sizes DMA buffer, sized for a grid equal to the PPS uAPI array capacity. Use the bounded v4l2_hevc_pps_num_tile_columns() / v4l2_hevc_pps_num_tile_rows() helpers so the loops stay inside the buffer.

Text from CVE List

Affected versions 14

  • Linuxaffected: cb5dd5a0fa518dff14ff2b90837c3c8f98f4dd5c before 6d192fc0d6faff25ecf6d52cbde4b939cb12c192CVE List
  • Linuxaffected: cb5dd5a0fa518dff14ff2b90837c3c8f98f4dd5c before 2887a98c03d97a6fcb6c2dab92956f2f4c402cddCVE List
  • Linuxaffected: cb5dd5a0fa518dff14ff2b90837c3c8f98f4dd5c before 62ae24639d22909a5724627a0467e4bde9704020CVE List
  • Linuxaffected: cb5dd5a0fa518dff14ff2b90837c3c8f98f4dd5c before 4f654c9bc954569ff9b8ab860b29480c4cf6f57bCVE List
  • Linuxaffected: cb5dd5a0fa518dff14ff2b90837c3c8f98f4dd5c before 05e8e4cdfe692f5cedba9aa9d7b8f2584cf926c8CVE List
  • Linuxaffected: cb5dd5a0fa518dff14ff2b90837c3c8f98f4dd5c before 06236b094c899c22c12ac5097935eb6719293de8CVE List
  • Linuxaffected: 5.14CVE List
  • Linuxunaffected: all versions before 5.14CVE List
  • Linuxunaffected: 6.1.189 through 6.1.*CVE List
  • Linuxunaffected: 6.6.158 through 6.6.*CVE List
  • Linuxunaffected: 6.12.111 through 6.12.*CVE List
  • Linuxunaffected: 6.18.53 through 6.18.*CVE List
  • Linuxunaffected: 7.2.7 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 6