HIGH Introduced in 5.14
verisilicon TileInfo OOB
CVE-2026-97581
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
01Description
In the Linux kernel, the following vulnerability has been resolved: media: verisilicon: hantro: bound G2 HEVC tile loop to the buffer capacity prepare_tile_info_buffer() writes one entry per tile into the tile_sizes DMA buffer, sized for a grid equal to the PPS uAPI array capacity. Use the bounded v4l2_hevc_pps_num_tile_columns() / v4l2_hevc_pps_num_tile_rows() helpers so the loops stay inside the buffer.
02KernelScan AI Analysis
Risk summary
A local attacker with access to a Hantro G2 HEVC hardware decoder device node can submit a crafted HEVC stream whose Picture Parameter Set declares more tile rows or columns than the driver's DMA buffer can hold. The tile-filling loop then writes past the end of that buffer, causing an out-of-bounds heap write. This can corrupt kernel memory, leading to denial of service or potential privilege escalation. Exploitation requires specific Verisilicon/Hantro G2 decoder hardware and only low (device-group) privileges.
Vulnerability analysis
The Hantro G2 HEVC decoder builds a tile-sizes DMA buffer by iterating over the number of tile rows and columns declared in the stream's Picture Parameter Set. The buffer is allocated for the maximum grid the uAPI supports, but the original code trusted the raw PPS values directly, so a crafted stream could claim more rows or columns than the buffer holds and the loop would write past its end. The fix replaces the unbounded counts with helper functions that clamp the row and column counts to the supported maximum, keeping every write inside the buffer. The vulnerable path is reached locally by any process that can open the HEVC decoder's V4L2 device node and submit a malicious HEVC bitstream; no special capabilities are required beyond device-node access, and the hardware (SoCs embedding Verisilicon/Hantro G2 video decoder IP) must be present.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.1 | 5.14 | 6.1.189 | 6d192fc0d6fa |
| 6.12 | 5.14 | 6.12.111 | 62ae24639d22 |
| 6.18 | 5.14 | 6.18.53 | 4f654c9bc954 |
| 6.6 | 5.14 | 6.6.158 | 2887a98c03d9 |
| 7.2 | 5.14 | 7.2.7 | 05e8e4cdfe69 |
| mainline | 5.14 | 7.3 | 06236b094c89 |
| cip/6.1 | 5.14 | 6.1.189-cip61 | 6d192fc0d6fa |
| cip/6.1-rt | 5.14 | 6.1.189-cip61-rt32 | 6d192fc0d6fa |
| cip/6.12 | 5.14 | 6.12.111-cip32 | 62ae24639d22 |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/6.12 | Fixed in 6.12.111-cip32 |
| cip/6.1 | Fixed in 6.1.189-cip61 |
| cip/6.1-rt | Fixed in 6.1.189-cip61-rt32 |