CVE-2026-97581: media: verisilicon: hantro: bound G2 HEVC tile loop to the buffer capacity
In the Linux kernel, the following vulnerability has been resolved:
media: verisilicon: hantro: bound G2 HEVC tile loop to the buffer capacity
preparetileinfobuffer() writes one entry per tile into the tilesizes DMA buffer, sized for a grid equal to the PPS uAPI array capacity. Use the bounded v4l2hevcppsnumtilecolumns() / v4l2hevcppsnumtilerows() helpers so the loops stay inside the buffer.
Affected Software
Event History
Frequently Asked Questions
What conditions are required to trigger this issue?
The affected code path must process HEVC tile information through the Verisilicon Hantro G2 media driver. Exploitation requires tile column or row values that cause prepare_tile_info_buffer() to iterate beyond the tile_sizes DMA buffer capacity.
What is the impact of the missing bounds check?
prepare_tile_info_buffer() can write one tile entry per loop iteration into a DMA buffer sized only for the PPS uAPI array capacity. Tile counts exceeding that capacity can cause writes outside the allocated buffer.
How is the issue fixed?
The fix uses the bounded v4l2_hevc_pps_num_tile_columns() and v4l2_hevc_pps_num_tile_rows() helpers for the tile loops, keeping iterations within the tile_sizes DMA buffer capacity.