Description

In the Linux kernel, the following vulnerability has been resolved: media: v4l2-ctrls: validate HEVC tile counts The stateless HEVC decoders read num_tile_columns_minus1 + 1 entries from column_width_minus1[] and num_tile_rows_minus1 + 1 from row_height_minus1[] and use them as tile-loop bounds, but std_validate_compound() does not bound these u8 counts. Reject a V4L2_CTRL_TYPE_HEVC_PPS with tiling enabled whose tile counts exceed the uAPI array capacity, mirroring the existing compound-control range checks.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-09-25T11:17:08.340Z",
  "pubdate": "2026-09-25T11:17:08.340Z",
  "executiveSummary": "The Linux kernel v4l2-ctrls subsystem is susceptible to an out-of-bounds access vulnerability within the stateless HEVC decoder implementation.\nThe vulnerability stems from improper validation of HEVC tile count parameters, specifically num_tile_columns_minus1 and num_tile_rows_minus1, during the processing of V4L2_CTRL_TYPE_HEVC_PPS control structures.\nBy supplying maliciously crafted tile counts, an attacker can induce the decoder to perform operations exceeding the allocated buffer capacity defined in the uAPI array.\nThis flaw impacts systems utilizing hardware-accelerated HEVC decoding via V4L2 and presents a critical risk of memory corruption, potentially leading to denial-of-service (kernel panic) or arbitrary code execution if successfully exploited.\nExploitation requires the ability to interface with the V4L2 subsystem, typically necessitating local access or specific permissions to the video device node.",
  "technicalDetails": "The vulnerability exists within the std_validate_compound() function in the media: v4l2-ctrls subsystem. This function is responsible for validating compound control structures, including the HEVC Picture Parameter Set (PPS).\nIn the context of the stateless HEVC decoder, the driver relies on tile counts defined by the user-provided num_tile_columns_minus1 and num_tile_rows_minus1 fields to iterate over the column_width_minus1[] and row_height_minus1[] arrays.\nThe root cause is the absence of bounds checking on these tile count variables within the validation logic. While the hardware structures have fixed-size uAPI array capacities, the current implementation fails to verify that the user-provided indices remain within these safety limits before utilizing them as loop bounds for memory access.\nThe attack flow proceeds as follows: 1) An attacker crafts a malicious V4L2_CTRL_TYPE_HEVC_PPS control structure with tiling enabled. 2) The attacker sets the num_tile_columns_minus1 or num_tile_rows_minus1 fields to values that exceed the defined limits of the internal arrays. 3) The malicious structure is passed to the kernel via ioctl. 4) The std_validate_compound() function fails to intercept the invalid dimensions. 5) The driver performs read or write operations using the attacker-supplied counts, resulting in an out-of-bounds memory access.\nBecause the decoder iterates based on these unchecked counts, it essentially treats user-controlled data as the loop condition for accessing memory. This can lead to read-side information leaks or write-side memory corruption, where adjacent memory addresses are overwritten by the decoder's buffer operations.\nThe vulnerable component is identified as the HEVC control validation routine in the V4L2 framework. This vulnerability is not restricted by network exposure, as it requires direct interaction with the video device; however, on systems where video device nodes are accessible to unprivileged users, this becomes a local privilege escalation vector. Post-exploitation impact ranges from system instability and kernel crashes to potential subversion of the kernel memory state."
}