CVE-2026-97575: media: v4l2-ctrls: validate AV1 tile counts
In the Linux kernel, the following vulnerability has been resolved:
media: v4l2-ctrls: validate AV1 tile counts
The stateless AV1 decoders use tileinfo.tilecols and tilerows as loop bounds and as indices into the mistarts[] and insbsminus1[] arrays, as the divisor for contextupdatetileid, and their product bounds the per-tile descriptor buffers, but stdvalidatecompound() does not bound these u8 fields. Reject a V4L2CTRLTYPEAV1FRAME whose tilecols or tilerows exceeds V4L2AV1MAXTILECOLS / ROWS, or whose product exceeds V4L2AV1MAXTILECOUNT. A zero tile count is left to the consuming driver so the zero-initialised control that existing userspace submits is still accepted.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Validate V4L2_CTRL_TYPE_AV1_FRAME controls and reject any control whose tile_cols exceeds V4L2_AV1_MAX_TILE_COLS, tile_rows exceeds V4L2_AV1_MAX_TILE_ROWS, or tile_cols multiplied by tile_rows exceeds V4L2_AV1_MAX_TILE_COUNT; continue accepting the zero-initialized control submitted by existing userspace.
Event History
Frequently Asked Questions
What access does an attacker need to trigger this issue?
An attacker needs to submit a V4L2_CTRL_TYPE_AV1_FRAME control to a stateless AV1 decoder with tile_cols or tile_rows values beyond the supported limits, or with a tile-count product beyond V4L2_AV1_MAX_TILE_COUNT.
Which configurations are exposed?
The affected path is the Linux kernel V4L2 control validation used by stateless AV1 decoders. Exposure depends on a system providing such a decoder interface to the party submitting AV1 frame controls.
How can I determine whether a system has the fix?
The fix causes validation to reject AV1 frame controls when tile_cols exceeds V4L2_AV1_MAX_TILE_COLS, tile_rows exceeds V4L2_AV1_MAX_TILE_ROWS, or their product exceeds V4L2_AV1_MAX_TILE_COUNT. The listed stable references contain the corresponding changes.
Are zero tile counts rejected by this validation?
No. Zero tile counts are intentionally left for the consuming driver to handle so that existing userspace submitting zero-initialized controls continues to be accepted.