Go to homepageCyberStrike

Menu

Star on GitHub · 3.4k
Sign inDownload

CVE-2026-97575

7.8 · HIGH

In the Linux kernel, the following vulnerability has been resolved: media: v4l2-ctrls: validate AV1 tile counts The stateless AV1 decoders use tile_info.tile_cols and tile_rows as loop bounds and…

Published Sep 25, 2026EPSS 0.16%

Overview

CVE-2026-97575 is a high-severity vulnerability. It was published on September 25, 2026 and has a CVSS 3.1 base score of 7.8 (HIGH).

This vulnerability has a CVSS 3.1 base score of 7.8, rated HIGH. It requires local or adjacent network access to exploit. Some level of privileges is required for exploitation.

Technical description

In the Linux kernel, the following vulnerability has been resolved:

media: v4l2-ctrls: validate AV1 tile counts

The stateless AV1 decoders use tile_info.tile_cols and tile_rows as loop

bounds and as indices into the mi_*_starts[] and *_in_sbs_minus_1[]

arrays, as the divisor for context_update_tile_id, and their product

bounds the per-tile descriptor buffers, but std_validate_compound() does

not bound these u8 fields. Reject a V4L2_CTRL_TYPE_AV1_FRAME whose

tile_cols or tile_rows exceeds V4L2_AV1_MAX_TILE_COLS / _ROWS, or whose

product exceeds V4L2_AV1_MAX_TILE_COUNT. A zero tile count is left to the

consuming driver so the zero-initialised control that existing userspace

submits is still accepted.

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References

Refgit.kernel.org/stable/c/1afaf85c4990fb1e3168d0d6e99246a65e526f1bRefgit.kernel.org/stable/c/439058ced617fbb3febc017b9e93bb7387f309e0Refgit.kernel.org/stable/c/85df9fc79b07f1cc7c953f930ae7e675d0c1e820Refgit.kernel.org/stable/c/c4c88b5ba85685043d171e0e9c9d00a8cf6a89e8Refgit.kernel.org/stable/c/c8891da0186fe4c04bccbbd7d84b01a3c941ac7a

How CyberStrike helps

Frequently asked questions

What is CVE-2026-97575?

CVE-2026-97575 is a high-severity vulnerability. It was published on September 25, 2026 and has a CVSS 3.1 base score of 7.8 (HIGH).

How severe is CVE-2026-97575?

This vulnerability has a CVSS 3.1 base score of 7.8, rated HIGH. It requires local or adjacent network access to exploit. Some level of privileges is required for exploitation.

How do I fix or remediate CVE-2026-97575?

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

How can CyberStrike help with CVE-2026-97575?

CyberStrike is an open-source, AI-augmented pentesting engine. Rather than flag a version number, it tests whether an issue like CVE-2026-97575 is actually reachable in your own applications and APIs, then verifies each finding before reporting it. That tells you if the weakness is a real, exploitable risk in your environment or a false positive you can safely deprioritize.

Related HIGH CVEs from 2026

View all
Browse by year2026202520242023202220212020201920182017201620152014201320122011201020092008200720062005200420032002200120001999
LiveWatch live →