CVE-2026-97576

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-97576", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-24T16:01:01.156Z", "datePublished": "2026-09-25T10:21:59.298Z", "dateUpdated": "2026-10-19T09:09:38.813Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:09:38.813Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: v4l2-ctrls: validate HEVC tile counts\n\nThe stateless HEVC decoders read num_tile_columns_minus1 + 1 entries from\ncolumn_width_minus1[] and num_tile_rows_minus1 + 1 from row_height_minus1[]\nand use them as tile-loop bounds, but std_validate_compound() does not\nbound these u8 counts. Reject a V4L2_CTRL_TYPE_HEVC_PPS with tiling\nenabled whose tile counts exceed the uAPI array capacity, mirroring the\nexisting compound-control range checks."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The attacker-controlled bytes are num_tile_columns_minus1, num_tile_rows_minus1 and column_width_minus1[]/row_height_minus1[] in struct v4l2_ctrl_hevc_pps, copied from userspace by VIDIOC_S_EXT_CTRLS through v4l_s_ext_ctrls \u2192 v4l2_s_ext_ctrls \u2192 user_to_new into std_validate_compound(); no network protocol carries those fields.\nAC:L - Setting V4L2_HEVC_PPS_FLAG_TILES_ENABLED with num_tile_columns_minus1>=20 or num_tile_rows_minus1>=22 is enough; the next decode job (hantro_g2_hevc_dec_run\u2192prepare_tile_info_buffer, rkvdec assemble_hw_pps\u2192compute_tiles_non_uniform, or cedrus_h265_setup\u2192cedrus_h265_write_tiles) uses those u8 counts as loop bounds with no race or hardware-fault precondition.\nPR:L - rkvdec_open(), hantro_open() and cedrus_open() perform no capable() check; v4l2_open only requires opening the decoder /dev/videoN. On Rockchip, Allwinner and Hantro devices that node is granted to unprivileged video-group or Android media-client users, not init-namespace root.\nUI:N - The attacking process opens the HEVC decoder itself, issues VIDIOC_S_EXT_CTRLS with the crafted V4L2_CTRL_TYPE_HEVC_PPS, then QBUF/STREAMON via the request API. No separate victim mount, file-open, or playback action is required.\nS:U - The overflows remain in kernel stack (vdpu383 assemble_hw_pps column_width[22]), hantro tile_sizes DMA memory, and the rkvdec param_set PPS packet. This is kernel memory corruption under the same security authority, not a VM, IOMMU, or sandbox escape.\nC:H - cedrus_h265_write_tiles() and compute_tiles_non_uniform() index column_width_minus1[20] and row_height_minus1[22] with a u8 count up to 255, reading past the v4l2_ctrl_hevc_pps object into adjacent kernel heap that is then copied into stack and DMA tile buffers.\nI:H - compute_tiles_non_uniform() writes attacker-chosen column_width_minus1[i]+1 values past stack arrays column_width[20/22]; prepare_tile_info_buffer() writes up to 256x256 u16 pairs into a 20x22 tile_sizes DMA buffer; rkvdec_set_bw_field() stores COLUMN_WIDTH(i) past the 80-byte PPS packet.\nA:H - The stack smash of column_width/row_height, the tile_sizes DMA overflow, and rkvdec_set_bw_field() writes past param_set can walk into unmapped or poisoned memory and oops the kernel, and can wedge the HEVC decoder hardware. The trigger is repeatable at will."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/media/v4l2-core/v4l2-ctrls-core.c"], "versions": [{"version": "256fa3920874b0f1f4cb79ad6766493a22187153", "lessThan": "9c0a718e24d4cd6d975f3df9740f968f62891a20", "status": "affected", "versionType": "git"}, {"version": "256fa3920874b0f1f4cb79ad6766493a22187153", "lessThan": "975e0180488966bb709092a52408604bd4f4edd9", "status": "affected", "versionType": "git"}, {"version": "256fa3920874b0f1f4cb79ad6766493a22187153", "lessThan": "724915535558b14c111ad8a498b896026dfe8d20", "status": "affected", "versionType": "git"}, {"version": "256fa3920874b0f1f4cb79ad6766493a22187153", "lessThan": "400cd78a63cc647412cf069c9851bdea2818340c", "status": "affected", "versionType": "git"}, {"version": "256fa3920874b0f1f4cb79ad6766493a22187153", "lessThan": "c7b1ef6dc57f4e57fe27cfdd3bf82033ed91ca34", "status": "affected", "versionType": "git"}, {"version": "256fa3920874b0f1f4cb79ad6766493a22187153", "lessThan": "ba1023d3a6d5d244d59f20c4ba6af4879ae08a9f", "status": "affected", "versionType": "git"}, {"version": "256fa3920874b0f1f4cb79ad6766493a22187153", "lessThan": "dc694a9929f7cb9c88ef91e45eb982b7bbe5a477", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/media/v4l2-core/v4l2-ctrls-core.c"], "versions": [{"version": "5.5", "status": "affected"}, {"version": "0", "lessThan": "5.5", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.222", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.189", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.158", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.111", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.53", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.7", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.5", "versionEndExcluding": "5.15.222"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.5", "versionEndExcluding": "6.1.189"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.5", "versionEndExcluding": "6.6.158"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.5", "versionEndExcluding": "6.12.111"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.5", "versionEndExcluding": "6.18.53"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.5", "versionEndExcluding": "7.2.7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.5", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/9c0a718e24d4cd6d975f3df9740f968f62891a20"}, {"url": "https://git.kernel.org/stable/c/975e0180488966bb709092a52408604bd4f4edd9"}, {"url": "https://git.kernel.org/stable/c/724915535558b14c111ad8a498b896026dfe8d20"}, {"url": "https://git.kernel.org/stable/c/400cd78a63cc647412cf069c9851bdea2818340c"}, {"url": "https://git.kernel.org/stable/c/c7b1ef6dc57f4e57fe27cfdd3bf82033ed91ca34"}, {"url": "https://git.kernel.org/stable/c/ba1023d3a6d5d244d59f20c4ba6af4879ae08a9f"}, {"url": "https://git.kernel.org/stable/c/dc694a9929f7cb9c88ef91e45eb982b7bbe5a477"}], "title": "media: v4l2-ctrls: validate HEVC tile counts", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/media/v4l2-core/v4l2-ctrls-core.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "9c0a718e24d4cd6d975f3df9740f968f62891a20", "status": "affected", "version": "256fa3920874b0f1f4cb79ad6766493a22187153", "versionType": "git"}, {"lessThan": "975e0180488966bb709092a52408604bd4f4edd9", "status": "affected", "version": "256fa3920874b0f1f4cb79ad6766493a22187153", "versionType": "git"}, {"lessThan": "724915535558b14c111ad8a498b896026dfe8d20", "status": "affected", "version": "256fa3920874b0f1f4cb79ad6766493a22187153", "versionType": "git"}, {"lessThan": "400cd78a63cc647412cf069c9851bdea2818340c", "status": "affected", "version": "256fa3920874b0f1f4cb79ad6766493a22187153", "versionType": "git"}, {"lessThan": "c7b1ef6dc57f4e57fe27cfdd3bf82033ed91ca34", "status": "affected", "version": "256fa3920874b0f1f4cb79ad6766493a22187153", "versionType": "git"}, {"lessThan": "ba1023d3a6d5d244d59f20c4ba6af4879ae08a9f", "status": "affected", "version": "256fa3920874b0f1f4cb79ad6766493a22187153", "versionType": "git"}, {"lessThan": "dc694a9929f7cb9c88ef91e45eb982b7bbe5a477", "status": "affected", "version": "256fa3920874b0f1f4cb79ad6766493a22187153", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/media/v4l2-core/v4l2-ctrls-core.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.5"}, {"lessThan": "5.5", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.222", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.189", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.158", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.111", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.53", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.7", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: v4l2-ctrls: validate HEVC tile counts\n\nThe stateless HEVC decoders read num_tile_columns_minus1 + 1 entries from\ncolumn_width_minus1[] and num_tile_rows_minus1 + 1 from row_height_minus1[]\nand use them as tile-loop bounds, but std_validate_compound() does not\nbound these u8 counts. Reject a V4L2_CTRL_TYPE_HEVC_PPS with tiling\nenabled whose tile counts exceed the uAPI array capacity, mirroring the\nexisting compound-control range checks."}], "id": "CVE-2026-97576", "lastModified": "2026-10-19T10:17:26.840", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-09-25T11:17:08.340", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/400cd78a63cc647412cf069c9851bdea2818340c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/724915535558b14c111ad8a498b896026dfe8d20"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/975e0180488966bb709092a52408604bd4f4edd9"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/9c0a718e24d4cd6d975f3df9740f968f62891a20"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ba1023d3a6d5d244d59f20c4ba6af4879ae08a9f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c7b1ef6dc57f4e57fe27cfdd3bf82033ed91ca34"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/dc694a9929f7cb9c88ef91e45eb982b7bbe5a477"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: media: v4l2-ctrls: validate HEVC tile counts", "id": "2541279", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2541279"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-125", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nmedia: v4l2-ctrls: validate HEVC tile counts\nThe stateless HEVC decoders read num_tile_columns_minus1 + 1 entries from\ncolumn_width_minus1[] and num_tile_rows_minus1 + 1 from row_height_minus1[]\nand use them as tile-loop bounds, but std_validate_compound() does not\nbound these u8 counts. Reject a V4L2_CTRL_TYPE_HEVC_PPS with tiling\nenabled whose tile counts exceed the uAPI array capacity, mirroring the\nexisting compound-control range checks.", "A flaw was found in the Linux kernel's Video4Linux2 (V4L2) subsystem. A local attacker can exploit this flaw by submitting a crafted High Efficiency Video Coding (HEVC) control structure with tile counts that exceed array limits. Because the kernel fails to validate these bounds properly, this issue can lead to an out-of-bounds memory read, resulting in a system crash and Denial of Service (DoS)."], "name": "CVE-2026-97576", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-09-25T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-97576\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-97576\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-97576.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[256fa3920874b0f1f4cb79ad6766493a22187153,400cd78a63cc647412cf069c9851bdea2818340c)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[256fa3920874b0f1f4cb79ad6766493a22187153,c7b1ef6dc57f4e57fe27cfdd3bf82033ed91ca34)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[256fa3920874b0f1f4cb79ad6766493a22187153,ba1023d3a6d5d244d59f20c4ba6af4879ae08a9f)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[256fa3920874b0f1f4cb79ad6766493a22187153,dc694a9929f7cb9c88ef91e45eb982b7bbe5a477)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "5.5"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,5.5)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.111,7.0.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.53,7.0.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.7,8.0.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3-rc3,*)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-09-25T13:00:15.590664+00:00", "updated": "2026-10-01T11:45:07.599223+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}