{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-97581", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-24T16:01:01.156Z", "datePublished": "2026-09-25T10:22:02.415Z", "dateUpdated": "2026-10-19T09:09:43.743Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:09:43.743Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: verisilicon: hantro: bound G2 HEVC tile loop to the buffer capacity\n\nprepare_tile_info_buffer() writes one entry per tile into the tile_sizes\nDMA buffer, sized for a grid equal to the PPS uAPI array capacity. Use the\nbounded v4l2_hevc_pps_num_tile_columns() / v4l2_hevc_pps_num_tile_rows()\nhelpers so the loops stay inside the buffer."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/media/platform/verisilicon/hantro_g2_hevc_dec.c"], "versions": [{"version": "cb5dd5a0fa518dff14ff2b90837c3c8f98f4dd5c", "lessThan": "6d192fc0d6faff25ecf6d52cbde4b939cb12c192", "status": "affected", "versionType": "git"}, {"version": "cb5dd5a0fa518dff14ff2b90837c3c8f98f4dd5c", "lessThan": "2887a98c03d97a6fcb6c2dab92956f2f4c402cdd", "status": "affected", "versionType": "git"}, {"version": "cb5dd5a0fa518dff14ff2b90837c3c8f98f4dd5c", "lessThan": "62ae24639d22909a5724627a0467e4bde9704020", "status": "affected", "versionType": "git"}, {"version": "cb5dd5a0fa518dff14ff2b90837c3c8f98f4dd5c", "lessThan": "4f654c9bc954569ff9b8ab860b29480c4cf6f57b", "status": "affected", "versionType": "git"}, {"version": "cb5dd5a0fa518dff14ff2b90837c3c8f98f4dd5c", "lessThan": "05e8e4cdfe692f5cedba9aa9d7b8f2584cf926c8", "status": "affected", "versionType": "git"}, {"version": "cb5dd5a0fa518dff14ff2b90837c3c8f98f4dd5c", "lessThan": "06236b094c899c22c12ac5097935eb6719293de8", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/media/platform/verisilicon/hantro_g2_hevc_dec.c"], "versions": [{"version": "5.14", "status": "affected"}, {"version": "0", "lessThan": "5.14", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.189", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.158", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.111", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.53", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.7", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.14", "versionEndExcluding": "6.1.189"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.14", "versionEndExcluding": "6.6.158"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.14", "versionEndExcluding": "6.12.111"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.14", "versionEndExcluding": "6.18.53"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.14", "versionEndExcluding": "7.2.7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.14", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/6d192fc0d6faff25ecf6d52cbde4b939cb12c192"}, {"url": "https://git.kernel.org/stable/c/2887a98c03d97a6fcb6c2dab92956f2f4c402cdd"}, {"url": "https://git.kernel.org/stable/c/62ae24639d22909a5724627a0467e4bde9704020"}, {"url": "https://git.kernel.org/stable/c/4f654c9bc954569ff9b8ab860b29480c4cf6f57b"}, {"url": "https://git.kernel.org/stable/c/05e8e4cdfe692f5cedba9aa9d7b8f2584cf926c8"}, {"url": "https://git.kernel.org/stable/c/06236b094c899c22c12ac5097935eb6719293de8"}], "title": "media: verisilicon: hantro: bound G2 HEVC tile loop to the buffer capacity", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/media/platform/verisilicon/hantro_g2_hevc_dec.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "6d192fc0d6faff25ecf6d52cbde4b939cb12c192", "status": "affected", "version": "cb5dd5a0fa518dff14ff2b90837c3c8f98f4dd5c", "versionType": "git"}, {"lessThan": "2887a98c03d97a6fcb6c2dab92956f2f4c402cdd", "status": "affected", "version": "cb5dd5a0fa518dff14ff2b90837c3c8f98f4dd5c", "versionType": "git"}, {"lessThan": "62ae24639d22909a5724627a0467e4bde9704020", "status": "affected", "version": "cb5dd5a0fa518dff14ff2b90837c3c8f98f4dd5c", "versionType": "git"}, {"lessThan": "4f654c9bc954569ff9b8ab860b29480c4cf6f57b", "status": "affected", "version": "cb5dd5a0fa518dff14ff2b90837c3c8f98f4dd5c", "versionType": "git"}, {"lessThan": "05e8e4cdfe692f5cedba9aa9d7b8f2584cf926c8", "status": "affected", "version": "cb5dd5a0fa518dff14ff2b90837c3c8f98f4dd5c", "versionType": "git"}, {"lessThan": "06236b094c899c22c12ac5097935eb6719293de8", "status": "affected", "version": "cb5dd5a0fa518dff14ff2b90837c3c8f98f4dd5c", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/media/platform/verisilicon/hantro_g2_hevc_dec.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.14"}, {"lessThan": "5.14", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.189", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.158", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.111", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.53", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.7", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: verisilicon: hantro: bound G2 HEVC tile loop to the buffer capacity\n\nprepare_tile_info_buffer() writes one entry per tile into the tile_sizes\nDMA buffer, sized for a grid equal to the PPS uAPI array capacity. Use the\nbounded v4l2_hevc_pps_num_tile_columns() / v4l2_hevc_pps_num_tile_rows()\nhelpers so the loops stay inside the buffer."}], "id": "CVE-2026-97581", "lastModified": "2026-10-19T10:17:27.440", "metrics": {}, "published": "2026-09-25T11:17:08.897", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/05e8e4cdfe692f5cedba9aa9d7b8f2584cf926c8"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/06236b094c899c22c12ac5097935eb6719293de8"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/2887a98c03d97a6fcb6c2dab92956f2f4c402cdd"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/4f654c9bc954569ff9b8ab860b29480c4cf6f57b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/62ae24639d22909a5724627a0467e4bde9704020"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/6d192fc0d6faff25ecf6d52cbde4b939cb12c192"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: media: verisilicon: hantro: bound G2 HEVC tile loop to the buffer capacity", "id": "2541108", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2541108"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-787", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nmedia: verisilicon: hantro: bound G2 HEVC tile loop to the buffer capacity\nprepare_tile_info_buffer() writes one entry per tile into the tile_sizes\nDMA buffer, sized for a grid equal to the PPS uAPI array capacity. Use the\nbounded v4l2_hevc_pps_num_tile_columns() / v4l2_hevc_pps_num_tile_rows()\nhelpers so the loops stay inside the buffer.", "A flaw was found in the Linux kernel's Hantro video decoder driver. When processing High Efficiency Video Coding (HEVC) video streams, the driver fails to validate the number of tile rows and columns against the allocated buffer capacity. A local attacker could exploit this vulnerability by submitting crafted video parameters to trigger an out-of-bounds memory write. This issue can lead to kernel memory corruption or a system crash, resulting in a Denial of Service (DoS)."], "name": "CVE-2026-97581", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-09-25T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-97581\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-97581\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-97581.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[cb5dd5a0fa518dff14ff2b90837c3c8f98f4dd5c,62ae24639d22909a5724627a0467e4bde9704020)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[cb5dd5a0fa518dff14ff2b90837c8f98f4dd5c,4f654c9bc954569ff9b8ab860b29480c4cf6f57b)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[cb5dd5a0fa518dff14ff2b90837c8f98f4dd5c,05e8e4cdfe692f5cedba9aa9d7b8f2584cf926c8)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[cb5dd5a0fa518dff14ff2b90837c8f98f4dd5c,06236b094c899c22c12ac5097935eb6719293de8)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "5.14"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,5.14)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.111,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.53,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.7,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3-rc3,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-09-25T13:00:15.588253+00:00", "updated": "2026-10-01T11:45:07.598618+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}