CVE-2026-43222 — media: verisilicon: AV1: Fix tile info buffer size
In the Linux kernel, the following vulnerability has been resolved: media: verisilicon: AV1: Fix tile info buffer size Each tile info is composed of: row_sb, col_sb, start_pos…
Published: 2026-05-06 · CVSS: 7.8 · CVSS 3.1
In the Linux kernel, the following vulnerability has been resolved: media: verisilicon: AV1: Fix tile info buffer size Each tile info is composed of: row_sb, col_sb, start_pos and end_pos (4 bytes each). So the total required memory is AV1_MAX_TILES * 16 bytes. Use the correct #define to allocate the buffer and avoid writing tile info in non-allocated memory.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7