CVE-2026-93101

A flaw was found in the Linux kernel's v4l2-async module. A local user, by disconnecting a specific USB device that uses the i2c tvp5150 driver, could trigger a system crash. This denial of service DoS vulnerability arises from an issue in how the sub-device is unregistered when its asynchronous...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: media: pvrusb2: fixed a memory leak in pvrprobe. The error handling code in pvr2hdwcreate forgets to unregister the v4l2 device. When pvr2hdwcreate returns back to pvr2contextcreate, it calls pvr2contextdestroy to destroy the...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: media: ipu3imggu: Fixed a NULL pointer dereferencing issue in active selection access. The IMGu driver handled this by first acquiring the pointers to the active devices, then attempting to use V4L2 subdev functions. Only after...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: media: vivid: fix compose-height boundary issue Syzkaller identified a bug: BUG: Unable to handle page faults for address: ffffc9000a3b1000 PF: Supervisor write access in kernel mode PF: Errorcode0x0002 – Not-present page PGD...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: media:v4l2-core: A potential resource leak has been fixed in v4l2fwnodeparselink. If the fwnodegraphgetremoteendpoint function fails, fwnode is known to be NULL. Therefore, fwnodehandlePUT is a no-op. Instead, the reference...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: Media: v4l2-fwnode: Fixed an issue where the subdevice owner was overwritten in v4l2asyncregistersubdevsensor The v4l2 helper function v4l2asyncregistersubdevensor calls v4l2asyncregistersubdev, which is a macro that expands to...

SUSE CVE-2026-97575

In the Linux kernel, the following vulnerability has been resolved: media: v4l2-ctrls: validate AV1 tile counts The stateless AV1 decoders use tileinfo.tilecols and tilerows as loop bounds and as indices into the mistarts and insbsminus1 arrays, as the divisor for contextupdatetileid, and their...

SUSE CVE-2026-97576

In the Linux kernel, the following vulnerability has been resolved: media: v4l2-ctrls: validate HEVC tile counts The stateless HEVC decoders read numtilecolumnsminus1 + 1 entries from columnwidthminus1 and numtilerowsminus1 + 1 from rowheightminus1 and use them as tile-loop bounds, but...

CVE-2026-97576

A flaw was found in the Linux kernel's Video4Linux2 V4L2 subsystem. A local attacker can exploit this flaw by submitting a crafted High Efficiency Video Coding HEVC control structure with tile counts that exceed array limits. Because the kernel fails to validate these bounds properly, this issue...

ROS-20260928-73-0044

The vulnerability of the v4l2subdevcallstatetry function in the include/media/v4l2-subdev.h module of the Linux kernel is related to the lack of memory release after the effective lifespan of the function has ended. Exploiting this vulnerability can allow an attacker to cause a service failure...

DEBIAN-CVE-2026-97576

In the Linux kernel, the following vulnerability has been resolved: media: v4l2-ctrls: validate HEVC tile counts The stateless HEVC decoders read numtilecolumnsminus1 + 1 entries from columnwidthminus1 and numtilerowsminus1 + 1 from rowheightminus1 and use them as tile-loop bounds, but...

DEBIAN-CVE-2026-97575

In the Linux kernel, the following vulnerability has been resolved: media: v4l2-ctrls: validate AV1 tile counts The stateless AV1 decoders use tileinfo.tilecols and tilerows as loop bounds and as indices into the mistarts and insbsminus1 arrays, as the divisor for contextupdatetileid, and their...

CVE-2026-97576

In the Linux kernel, the following vulnerability has been resolved: media: v4l2-ctrls: validate HEVC tile counts The stateless HEVC decoders read numtilecolumnsminus1 + 1 entries from columnwidthminus1 and numtilerowsminus1 + 1 from rowheightminus1 and use them as tile-loop bounds, but...

CVE-2026-97575

In the Linux kernel, the following vulnerability has been resolved: media: v4l2-ctrls: validate AV1 tile counts The stateless AV1 decoders use tileinfo.tilecols and tilerows as loop bounds and as indices into the mistarts and insbsminus1 arrays, as the divisor for contextupdatetileid, and their...

AZL-104780 CVE-2026-97575 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: media: v4l2-ctrls: validate AV1 tile counts The stateless AV1 decoders use tileinfo.tilecols and tilerows as loop bounds and as indices into the mistarts and insbsminus1 arrays, as the divisor for contextupdatetileid, and their...

AZL-104399 CVE-2026-97576 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: media: v4l2-ctrls: validate HEVC tile counts The stateless HEVC decoders read numtilecolumnsminus1 + 1 entries from columnwidthminus1 and numtilerowsminus1 + 1 from rowheightminus1 and use them as tile-loop bounds, but...

UBUNTU-CVE-2026-97575

In the Linux kernel, the following vulnerability has been resolved: media: v4l2-ctrls: validate AV1 tile counts The stateless AV1 decoders use tileinfo.tilecols and tilerows as loop bounds and as indices into the mistarts and insbsminus1 arrays, as the divisor for contextupdatetileid, and their...

UBUNTU-CVE-2026-97576

In the Linux kernel, the following vulnerability has been resolved: media: v4l2-ctrls: validate HEVC tile counts The stateless HEVC decoders read numtilecolumnsminus1 + 1 entries from columnwidthminus1 and numtilerowsminus1 + 1 from rowheightminus1 and use them as tile-loop bounds, but...

CVE-2026-97576

The Linux kernel contains a vulnerability in the v4l2-ctrls component where stateless HEVC decoders fail to bound u8 counts for num_tile_columns_minus1 and num_tile_rows_minus1 . Specifically, the std_validate_compound() function does not validate these counts, allowing them to be used as tile-lo...

EUVD-2026-86884

In the Linux kernel, the following vulnerability has been resolved: media: v4l2-ctrls: validate HEVC tile counts The stateless HEVC decoders read numtilecolumnsminus1 + 1 entries from columnwidthminus1 and numtilerowsminus1 + 1 from rowheightminus1 and use them as tile-loop bounds, but...