CVE-2026-97576: media: v4l2-ctrls: validate HEVC tile counts
In the Linux kernel, the following vulnerability has been resolved:
media: v4l2-ctrls: validate HEVC tile counts
The stateless HEVC decoders read numtilecolumnsminus1 + 1 entries from columnwidthminus1[] and numtilerowsminus1 + 1 from rowheightminus1[] and use them as tile-loop bounds, but stdvalidatecompound() does not bound these u8 counts. Reject a V4L2CTRLTYPEHEVCPPS with tiling enabled whose tile counts exceed the uAPI array capacity, mirroring the existing compound-control range checks.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.158.1-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.190-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Compensating control
Reject a V4L2_CTRL_TYPE_HEVC_PPS control when tiling is enabled and num_tile_columns_minus1 or num_tile_rows_minus1 would cause reads beyond the uAPI column_width_minus1[] or row_height_minus1[] array capacity.
Event History
Frequently Asked Questions
What conditions are required to trigger the issue?
An HEVC stateless decoder must process a V4L2_CTRL_TYPE_HEVC_PPS control with tiling enabled. The supplied tile column or row count must exceed the capacity of the corresponding uAPI array.
What input is validated by the fix?
The fix rejects tiled HEVC PPS controls when num_tile_columns_minus1 or num_tile_rows_minus1 would cause the decoder to read more column_width_minus1[] or row_height_minus1[] entries than the uAPI arrays can hold.
How can I determine whether a system has the fix?
Check whether the installed kernel includes one of the referenced stable commits: 400cd78a63cc647412cf069c9851bdea2818340c, c7b1ef6dc57f4e57fe27cfdd3bf82033ed91ca34, or ba1023d3a6d5d244d59f20c4ba6af4879ae08a9f.