HIGH Introduced in 5.5
v4l2 HevcTile OOB
CVE-2026-97576
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI7.0HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: media: v4l2-ctrls: validate HEVC tile counts The stateless HEVC decoders read num_tile_columns_minus1 + 1 entries from column_width_minus1[] and num_tile_rows_minus1 + 1 from row_height_minus1[] and use them as tile-loop bounds, but std_validate_compound() does not bound these u8 counts. Reject a V4L2_CTRL_TYPE_HEVC_PPS with tiling enabled whose tile counts exceed the uAPI array capacity, mirroring the existing compound-control range checks.
02KernelScan AI Analysis
Risk summary
A local user with access to a V4L2 stateless HEVC decoder device can set a HEVC PPS control with tile column/row counts that exceed the kernel's fixed-size tile dimension arrays, causing the decoder driver to read out of bounds. This can leak kernel heap data and crash the decoder, producing a repeatable denial of service. Reachability requires both local device-node access and hardware (or driver) support for stateless HEVC decoding.
Vulnerability analysis
The video pipeline's validation step for stateless HEVC decode settings did not check that the tile layout dimensions fit within the fixed-size arrays that store them. When a stateless HEVC decoder later processes a frame, it uses those dimensions as loop bounds and reads past the end of the arrays, pulling in unintended kernel memory. The fix adds explicit range checks during control validation so that any setting with tiling enabled whose dimensions exceed the array capacity is rejected before it reaches a decoder. The bug is reachable by any local user who can open a stateless HEVC decoder device node, which typically requires membership in the video group or equivalent local privilege; the specific hardware or driver must also be present.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 5.15 | 5.5 | 5.15.222 | 9c0a718e24d4 |
| 6.1 | 5.5 | 6.1.189 | 975e01804889 |
| 6.12 | 5.5 | 6.12.111 | 400cd78a63cc |
| 6.18 | 5.5 | 6.18.53 | c7b1ef6dc57f |
| 6.6 | 5.5 | 6.6.158 | 724915535558 |
| 7.2 | 5.5 | 7.2.7 | ba1023d3a6d5 |
| mainline | 5.5 | 7.3 | dc694a9929f7 |
| cip/6.1 | 5.5 | 6.1.189-cip61 | 975e01804889 |
| cip/6.1-rt | 5.5 | 6.1.189-cip61-rt32 | 975e01804889 |
| cip/6.12 | 5.5 | 6.12.111-cip32 | 400cd78a63cc |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/6.12 | Fixed in 6.12.111-cip32 |
| cip/6.1 | Fixed in 6.1.189-cip61 |
| cip/6.1-rt | Fixed in 6.1.189-cip61-rt32 |
| cip/5.10 | Affected — no CIP fix yet (latest 5.10.271-cip78) |
| cip/5.10-rt | Affected — no CIP fix yet (latest 5.10.268-cip77-rt34) |