Description

In the Linux kernel, the following vulnerability has been resolved: media: v4l2-ctrls: validate AV1 tile counts The stateless AV1 decoders use tile_info.tile_cols and tile_rows as loop bounds and as indices into the mi_*_starts[] and *_in_sbs_minus_1[] arrays, as the divisor for context_update_tile_id, and their product bounds the per-tile descriptor buffers, but std_validate_compound() does not bound these u8 fields. Reject a V4L2_CTRL_TYPE_AV1_FRAME whose tile_cols or tile_rows exceeds V4L2_AV1_MAX_TILE_COLS / _ROWS, or whose product exceeds V4L2_AV1_MAX_TILE_COUNT. A zero tile count is left to the consuming driver so the zero-initialised control that existing userspace submits is still accepted.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-09-25T11:17:08.230Z",
  "pubdate": "2026-09-25T11:17:08.230Z",
  "executiveSummary": "The Linux kernel's media subsystem contains a vulnerability in the v4l2-ctrls framework related to the handling of AV1 stateless decoder control structures.\nThe vulnerability involves a lack of input validation for tile count parameters within the V4L2_CTRL_TYPE_AV1_FRAME control structure.\nThis missing validation allows for an integer-based logical flaw where excessive tile rows or columns can lead to out-of-bounds memory access.\nAttackers with sufficient permissions to access the media device can potentially trigger kernel-mode memory corruption.\nThe impact includes potential local privilege escalation, system instability, or kernel crashes, posing a significant risk to system integrity.\nExploitation requires an attacker to possess the capability to submit crafted V4L2 controls to the affected media controller interface.",
  "technicalDetails": "The root cause of this vulnerability lies in the insufficient bounds checking within the std_validate_compound() function in the v4l2-ctrls module. Stateless AV1 decoders rely on tile_info.tile_cols and tile_info.tile_rows fields provided by userspace to determine loop iteration counts and array indices.\nSpecifically, these fields are utilized as indices for the mi_row_starts, mi_col_starts, width_in_sbs_minus_1, and height_in_sbs_minus_1 arrays. Furthermore, the product of tile_cols and tile_rows serves as the basis for calculating the bounds of per-tile descriptor buffers.\nBecause the input fields are defined as u8 types and are not validated against the hardware-defined constants V4L2_AV1_MAX_TILE_COLS, V4L2_AV1_MAX_TILE_ROWS, or V4L2_AV1_MAX_TILE_COUNT, an attacker can supply values that exceed the allocated size of the kernel-resident buffers.\nThe attack flow commences with the attacker calling the ioctl interface associated with the media controller to set the AV1 frame control parameters. By providing maliciously crafted tile_cols and tile_rows values, the attacker forces the kernel's decoder logic to access memory locations outside the intended bounds of the tile-related arrays.\nThis out-of-bounds access manifests during the kernel's processing of the frame descriptor. Because these values are also used as divisors for the context_update_tile_id calculation, malformed input may also lead to arithmetic exceptions or unintended control flow paths.\nIf the product of the tile dimensions exceeds the pre-calculated limits for the per-tile descriptor buffers, a heap or stack-based buffer overflow can occur when the kernel writes metadata into these structures. This permits an attacker to corrupt adjacent kernel memory structures, potentially hijacking control flow if sensitive function pointers or object headers are overwritten.\nThe vulnerability is exposed through the V4L2 interface, typically accessed by local processes interacting with video hardware. Authentication is generally handled by the filesystem permissions on the /dev/video* device nodes, meaning any process with sufficient local privileges can exploit this flaw."
}