CVE-2026-97576media: v4l2-ctrls: validate HEVC tile counts
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: media: v4l2-ctrls: validate HEVC tile counts The stateless HEVC decoders read num_tile_columns_minus1 + 1 entries from column_width_minus1[] and num_tile_rows_minus1 + 1 from row_height_minus1[] and use them as tile-loop bounds, but std_validate_compound() does not bound these u8 counts. Reject a V4L2_CTRL_TYPE_HEVC_PPS with tiling enabled whose tile counts exceed the uAPI array capacity, mirroring the existing compound-control range checks.
- CVSS
- 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 3, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | 256fa3920874b0f1f4cb79ad6766493a22187153 builds before 9c0a718e24d4cd6d975f3df9740f968f62891a20; from 256fa3920874b0f1f4cb79ad6766493a22187153 before 975e0180488966bb709092a52408604bd4f4edd9; from 256fa3920874b0f1f4cb79ad6766493a22187153 before 724915535558b14c111ad8a498b896026dfe8d20; from 256fa3920874b0f1f4cb79ad6766493a22187153 before 400cd78a63cc647412cf069c9851bdea2818340c; from 256fa3920874b0f1f4cb79ad6766493a22187153 before c7b1ef6dc57f4e57fe27cfdd3bf82033ed91ca34; from 256fa3920874b0f1f4cb79ad6766493a22187153 before ba1023d3a6d5d244d59f20c4ba6af4879ae08a9f; from 256fa3920874b0f1f4cb79ad6766493a22187153 before dc694a9929f7cb9c88ef91e45eb982b7bbe5a477 | CNA record |
References
- https://git.kernel.org/stable/c/9c0a718e24d4cd6d975f3df9740f968f62891a20
- https://git.kernel.org/stable/c/975e0180488966bb709092a52408604bd4f4edd9
- https://git.kernel.org/stable/c/724915535558b14c111ad8a498b896026dfe8d20
- https://git.kernel.org/stable/c/400cd78a63cc647412cf069c9851bdea2818340c
- https://git.kernel.org/stable/c/c7b1ef6dc57f4e57fe27cfdd3bf82033ed91ca34
- https://git.kernel.org/stable/c/ba1023d3a6d5d244d59f20c4ba6af4879ae08a9f
- https://git.kernel.org/stable/c/dc694a9929f7cb9c88ef91e45eb982b7bbe5a477
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.