The Linux kernel’s AV1 video decoder in the v4l2-ctrls module does not enforce bounds on the tile_cols and tile_rows fields received from V4L2 controls. These values are used directly as loop limits and array indexes, and their product is used to determine buffer sizes. Because the kernel fails to validate that the u8 fields stay within V4L2_AV1_MAX_TILE_COLS / V4L2_AV1_MAX_TILE_ROWS limits, an attacker can supply values that exceed the allowed maximums. The unchecked values can cause out-of-bounds reads or writes, which in a kernel context can trigger a crash or corrupt kernel memory, potentially allowing privilege escalation if the attacker controls kernel execution paths.

The flaw exists in any Linux kernel version containing the v4l2-ctrls driver before the commit that adds bounds checks (439058c). All builds of the Linux kernel that compile this module with AV1 decoding enabled are vulnerable until the patch is applied. No specific kernel release version is listed as fixed, so systems running unpatched kernels with AV1 decoding enabled are at risk.

This vulnerability has a CVSS score of 7.8, which denotes high severity. The EPSS score is less than 1%, indicating a low probability of exploitation in the wild, but the flaw is still actionable. It is not currently listed in CISA’s KEV catalog. Exploitation requires control over V4L2 AV1 controls, which typically means local or device-level access. On systems where untrusted users can set these controls, the risk of accidental or malicious kernel crashes or privilege escalation is elevated. The attack vector is inferred to be local, via the V4L2 control interface, as no network-exposed exploit is described.