The Linux kernel AV1 decoder incorrectly calculates the buffer size for tile information, allocating less memory than required. Each tile should account for 16 bytes of metadata, yet the wrong constant led to writes beyond the allocated buffer. This kernel memory corruption can overwrite critical data structures, potentially allowing an attacker to execute arbitrary code with kernel privileges or induce system instability. This is a buffer overflow flaw classified as CWE-131.

The vulnerability is present in the Linux kernel media subsystem’s AV1 decoder whenever the affected kernel source is used. All distributions shipping a kernel build that has not applied the buffer‑size fix are potentially impacted. No specific kernel version range is listed in the advisory, so any kernel compiled from the unpatched code contains the flaw.

Buffer overflows in kernel space pose a high-security risk because they can give an attacker elevated privileges. The vulnerability requires exploitation in a kernel context; no network‑exposed trigger or publicly available exploit is documented. The CVSS score of 7.8 indicates a high severity, while the EPSS score of < 1% indicates a very low current exploitation probability. The issue is not listed in CISA's KEV catalog, which suggests that widespread exploitation has not yet been observed. The likely attack vector is inferred to be local privileged or compromised kernel access, as the flaw does not expose a remote entry point in the current description.