Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.
VOLERION
Volerion Security Research

NOT DEFERRED DATABASE

VULNERABILITIES

CVE-2026-97576 Details

Description

In the Linux kernel, the following vulnerability has been resolved: media: v4l2-ctrls: validate HEVC tile counts The stateless HEVC decoders read num_tile_columns_minus1 + 1 entries from column_width_minus1[] and num_tile_rows_minus1 + 1 from row_height_minus1[] and use them as tile-loop bounds, but std_validate_compound() does not bound these u8 counts. Reject a V4L2_CTRL_TYPE_HEVC_PPS with tiling enabled whose tile counts exceed the uAPI array capacity, mirroring the existing compound-control range checks.

Metrics

CVSS 3.x Severity and Vector Strings:

CNA: kernel.orgCVSS-B:7.8 HIGHVector:CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URLSource(s)Tag(s)
https://git.kernel.org/stable/c/400cd78a63cc647412cf069c9851bdea2818340c kernel.org
https://git.kernel.org/stable/c/ba1023d3a6d5d244d59f20c4ba6af4879ae08a9f kernel.org
https://git.kernel.org/stable/c/c7b1ef6dc57f4e57fe27cfdd3bf82033ed91ca34 kernel.org
https://git.kernel.org/stable/c/dc694a9929f7cb9c88ef91e45eb982b7bbe5a477 kernel.org

Weakness Enumeration

No weakness enumeration is available for this CVE.

Affected Products

No affected product data is available for this CVE.

Change History

2 change records found show changes

QUICK INFO

CVE Dictionary Entry:
CVE-2026-97576
NVD Published Date:
Sep 25, 2026
NVD Last Modified:
Sep 25, 2026
Source:
kernel.org
CVE-2026-97576 Details - Not Deferred