HIGH Introduced in 6.5
v4l2-ctrls TileCount OOB
CVE-2026-97575
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI7.8HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: media: v4l2-ctrls: validate AV1 tile counts The stateless AV1 decoders use tile_info.tile_cols and tile_rows as loop bounds and as indices into the mi_*_starts[] and *_in_sbs_minus_1[] arrays, as the divisor for context_update_tile_id, and their product bounds the per-tile descriptor buffers, but std_validate_compound() does not bound these u8 fields. Reject a V4L2_CTRL_TYPE_AV1_FRAME whose tile_cols or tile_rows exceeds V4L2_AV1_MAX_TILE_COLS / _ROWS, or whose product exceeds V4L2_AV1_MAX_TILE_COUNT. A zero tile count is left to the consuming driver so the zero-initialised control that existing userspace submits is still accepted.
02KernelScan AI Analysis
Risk summary
A local process with access to a V4L2 stateless AV1 decoder device can submit a frame control with tile column or row counts exceeding the decoder's fixed array bounds, causing out-of-bounds memory access in the kernel. This can lead to kernel memory corruption, information disclosure, or a crash. The bug requires a system running a stateless AV1 decoder driver (introduced in kernel 6.5) and local access to the corresponding video device node.
Vulnerability analysis
The V4L2 control validation layer accepts AV1 frame parameters without checking the tile column and row counts, but stateless AV1 decoder drivers use those counts as loop bounds and array indices into fixed-size per-tile descriptor arrays. A process that can open a V4L2 AV1 decoder device node can therefore submit a frame control with tile counts exceeding the maximum allowed values, causing the driver to read or write past the end of kernel arrays and corrupt adjacent memory. The fix adds bounds checks in the control validation path that reject any frame whose tile dimensions exceed the AV1 maximums or whose tile count product exceeds the total limit, before the values ever reach a driver. The vulnerable surface is reachable locally from any process that can access the video device, with no special capability beyond device-node access; the driver must be present and loaded, which requires compatible hardware or kernel configuration.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.12 | 6.5 | 6.12.111 | 85df9fc79b07 |
| 6.18 | 6.5 | 6.18.53 | c8891da0186f |
| 6.6 | 6.5 | 6.6.158 | 1afaf85c4990 |
| 7.2 | 6.5 | 7.2.7 | c4c88b5ba856 |
| mainline | 6.5 | 7.3 | 439058ced617 |
| cip/6.12 | 6.5 | 6.12.111-cip32 | 85df9fc79b07 |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/6.12 | Fixed in 6.12.111-cip32 |