CVE-2026-93236: media: meson: vdec: fix NULL pointer deref in vdec_try_fmt_common
In the Linux kernel, the following vulnerability has been resolved:
media: meson: vdec: fix NULL pointer deref in vdectryfmtcommon
When VIDIOCTRYFMT is called with an unsupported pixel format on the OUTPUT queue, vdectryfmtcommon() falls back to V4L2PIXFMTMPEG2. However, if a distro has locally patched MPEG2 support out (as it has been broken for some time) the platform format table does not contain MPEG2 so findformat() returns NULL and the subsequent dereference of fmtout->maxwidth triggers a NULL pointer dereference.
Fix this by falling back to the first format in the platform's format array instead of hardcoding V4L2PIXFMTMPEG2. This is always valid since every platform defines at least one format.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this NULL pointer dereference?
The issue affects Meson VDEC systems where MPEG2 support has been locally removed from the platform format table. It is triggered on the V4L2 OUTPUT queue when an unsupported pixel format is supplied to VIDIOC_TRY_FMT.
What does an attacker or local user need to do to trigger the failure?
They need access to issue the VIDIOC_TRY_FMT ioctl against the affected video decoder OUTPUT queue and provide an unsupported pixel format. The vulnerable fallback then attempts to use MPEG2 even though no MPEG2 format entry exists.
How can I determine whether a system is vulnerable?
Check whether the Meson VDEC driver's platform format table has locally patched-out MPEG2 support. Affected code falls back to V4L2_PIX_FMT_MPEG2 for unsupported OUTPUT formats rather than selecting the first available platform format.
What is the relevant mitigation if an update cannot be applied immediately?
Avoid allowing untrusted users or applications to access the affected V4L2 decoder interface and issue VIDIOC_TRY_FMT requests with unsupported OUTPUT pixel formats. The provided data does not identify another configuration-level workaround.