CVE-2026-97575: Linux

Описание

Оригинално описание

In the Linux kernel, the following vulnerability has been resolved: media: v4l2-ctrls: validate AV1 tile counts The stateless AV1 decoders use tile_info.tile_cols and tile_rows as loop bounds and as indices into the mi_*_starts[] and *_in_sbs_minus_1[] arrays, as the divisor for context_update_tile_id, and their product bounds the per-tile descriptor buffers, but std_validate_compound() does not bound these u8 fields. Reject a V4L2_CTRL_TYPE_AV1_FRAME whose tile_cols or tile_rows exceeds V4L2_AV1_MAX_TILE_COLS / _ROWS, or whose product exceeds V4L2_AV1_MAX_TILE_COUNT. A zero tile count is left to the consuming driver so the zero-initialised control that existing userspace submits is still accepted.

Засегнати продукти

• Linux Linux: 9de30f579980b498606a9c2440b73ae3b670771b преди 1afaf85c4990fb1e3168d0d6e99246a65e526f1b; 9de30f579980b498606a9c2440b73ae3b670771b преди 85df9fc79b07f1cc7c953f930ae7e675d0c1e820; 9de30f579980b498606a9c2440b73ae3b670771b преди c8891da0186fe4c04bccbbd7d84b01a3c941ac7a; 9de30f579980b498606a9c2440b73ae3b670771b преди c4c88b5ba85685043d171e0e9c9d00a8cf6a89e8; 9de30f579980b498606a9c2440b73ae3b670771b преди 439058ced617fbb3febc017b9e93bb7387f309e0
• Linux Linux: 6.5; преди 6.5; 6.6.158 до 6.6.*; 6.12.111 до 6.12.*; 6.18.53 до 6.18.*; 7.2.7 до 7.2.*; от 7.3 нататък

История

Други уязвимости в Linux Linux

• 8.1CVE-2026-99270
• 7.8CVE-2026-99269
• CVE-2026-99268
• CVE-2026-99266
• CVE-2026-99267

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2026-97575
• https://nvd.nist.gov/vuln/detail/CVE-2026-97575
• https://git.kernel.org/stable/c/1afaf85c4990fb1e3168d0d6e99246a65e526f1b
• https://git.kernel.org/stable/c/85df9fc79b07f1cc7c953f930ae7e675d0c1e820
• https://git.kernel.org/stable/c/c8891da0186fe4c04bccbbd7d84b01a3c941ac7a
• https://git.kernel.org/stable/c/c4c88b5ba85685043d171e0e9c9d00a8cf6a89e8
• https://git.kernel.org/stable/c/439058ced617fbb3febc017b9e93bb7387f309e0