CVE-2026-97576

Received Received - Intake

V4L2 HEVC Tile Count Validation Flaw in Linux Kernel

Publication date: 2026-09-25

Last updated on: 2026-10-03

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: media: v4l2-ctrls: validate HEVC tile counts The stateless HEVC decoders read num_tile_columns_minus1 + 1 entries from column_width_minus1[] and num_tile_rows_minus1 + 1 from row_height_minus1[] and use them as tile-loop bounds, but std_validate_compound() does not bound these u8 counts. Reject a V4L2_CTRL_TYPE_HEVC_PPS with tiling enabled whose tile counts exceed the uAPI array capacity, mirroring the existing compound-control range checks.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-10-03

Generated

2026-10-15

AI Q&A

2026-09-25

EPSS Evaluated

2026-10-14

NVD

CVE-2026-97576

EUVD

EUVD-2026-86884

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves improper validation of HEVC tile counts in the V4L2 controls subsystem. Stateless HEVC decoders read tile count values without proper bounds checking, potentially allowing out-of-bounds access when processing video streams with excessive tile configurations.

Detection Guidance

This vulnerability affects the Linux kernel's V4L2 controls for HEVC video decoding. Detection requires checking kernel versions and V4L2 driver implementations. Use 'uname -a' to check kernel version and 'lsmod | grep videodev' to verify V4L2 modules are loaded. Inspect HEVC PPS controls with 'v4l2-ctl --list-ctrls' for malformed tile configurations.

Impact Analysis

This vulnerability could allow an attacker to cause a denial of service or potentially execute arbitrary code by providing a maliciously crafted video stream with invalid HEVC tile counts. Systems processing untrusted media files may be particularly affected.

Compliance Impact

This vulnerability does not directly impact compliance with GDPR, HIPAA, or similar standards. It is a local privilege escalation issue in the Linux kernel's media subsystem affecting HEVC video decoding. Compliance risks would only arise if exploitation leads to unauthorized system access, which could potentially expose sensitive data governed by these regulations.

Mitigation Strategies

Update the Linux kernel to the latest stable version that includes the fix. If using a distribution kernel, apply vendor patches immediately. Disable HEVC decoding via V4L2 if not required by removing 'CONFIG_VIDEO_HEVC' from kernel config or blacklisting the module.

Hi! I’m here to help you understand CVE-2026-97576. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70