CVE-2026-43310: media: verisilicon: Avoid G2 bus error while decoding H.264 and HEVC
In the Linux kernel, the following vulnerability has been resolved:
media: verisilicon: Avoid G2 bus error while decoding H.264 and HEVC
For the i.MX8MQ platform, there is a hardware limitation: the g1 VPU and g2 VPU cannot decode simultaneously; otherwise, it will cause below bus error and produce corrupted pictures, even potentially lead to system hang.
[ 110.527986] hantro-vpu 38310000.video-codec: frame decode timed out. [ 110.583517] hantro-vpu 38310000.video-codec: bus error detected.
Therefore, it is necessary to ensure that g1 and g2 operate alternately. This allows for successful multi-instance decoding of H.264 and HEVC.
To achieve this, g1 and g2 share the same v4l2m2mdev, and then the v4l2m2mdev can handle the scheduling.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.191 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.160 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.114 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.57 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.19.6 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.19.6-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.2.12-1Fixed in 7.2.14-1 - Configuration
Configure the verisilicon driver so that g1 and g2 share the same v4l2_m2m_dev, allowing scheduling to prevent simultaneous decoding of H.264 and HEVC.
media: verisilicon on i.MX8MQ v4l2_m2m_dev sharing and scheduling = g1 VPU and g2 VPU share the same v4l2_m2m_dev and operate alternately
Event History
Frequently Asked Questions
What is the severity of CVE-2026-43310?
CVE-2026-43310 has a moderate severity level due to potential bus errors during video decoding.
How do I fix CVE-2026-43310?
To fix CVE-2026-43310, ensure that your Linux kernel and VeriSilicon media driver are updated to the latest version that addresses this vulnerability.
What platforms are affected by CVE-2026-43310?
The CVE-2026-43310 vulnerability primarily affects the i.MX8MQ platform using the VeriSilicon Linux kernel media driver.
What types of decoding are impacted by CVE-2026-43310?
CVE-2026-43310 impacts the decoding of H.264 and HEVC formats.
Who is the vendor associated with CVE-2026-43310?
The vendor associated with CVE-2026-43310 is VeriSilicon.