CVE-2026-97575media: v4l2-ctrls: validate AV1 tile counts
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: media: v4l2-ctrls: validate AV1 tile counts The stateless AV1 decoders use tile_info.tile_cols and tile_rows as loop bounds and as indices into the mi_*_starts[] and *_in_sbs_minus_1[] arrays, as the divisor for context_update_tile_id, and their product bounds the per-tile descriptor buffers, but std_validate_compound() does not bound these u8 fields. Reject a V4L2_CTRL_TYPE_AV1_FRAME whose tile_cols or tile_rows exceeds V4L2_AV1_MAX_TILE_COLS / _ROWS, or whose product exceeds V4L2_AV1_MAX_TILE_COUNT. A zero tile count is left to the consuming driver so the zero-initialised control that existing userspace submits is still accepted.
- CVSS
- 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 3, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | 9de30f579980b498606a9c2440b73ae3b670771b builds before 1afaf85c4990fb1e3168d0d6e99246a65e526f1b; from 9de30f579980b498606a9c2440b73ae3b670771b before 85df9fc79b07f1cc7c953f930ae7e675d0c1e820; from 9de30f579980b498606a9c2440b73ae3b670771b before c8891da0186fe4c04bccbbd7d84b01a3c941ac7a; from 9de30f579980b498606a9c2440b73ae3b670771b before c4c88b5ba85685043d171e0e9c9d00a8cf6a89e8; from 9de30f579980b498606a9c2440b73ae3b670771b before 439058ced617fbb3febc017b9e93bb7387f309e0 | CNA record |
References
- https://git.kernel.org/stable/c/1afaf85c4990fb1e3168d0d6e99246a65e526f1b
- https://git.kernel.org/stable/c/85df9fc79b07f1cc7c953f930ae7e675d0c1e820
- https://git.kernel.org/stable/c/c8891da0186fe4c04bccbbd7d84b01a3c941ac7a
- https://git.kernel.org/stable/c/c4c88b5ba85685043d171e0e9c9d00a8cf6a89e8
- https://git.kernel.org/stable/c/439058ced617fbb3febc017b9e93bb7387f309e0
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.