The AV1 decoder driver in the Linux kernel uses tile configuration fields from V4L2 controls without validating their bounds. Attackers can supply tile_cols and tile_rows values beyond the defined maximums. Because the driver uses those values as loop bounds and array indexes, the unchecked values can cause memory corruption or crash. This vulnerability may allow malicious users to crash the kernel or potentially execute arbitrary code, depending on kernel's memory protection.

The vulnerability affects the Linux kernel's v4l2-ctrls module when AV1 decoding is enabled. It is present in any kernel version that includes this driver code before the update referenced by commit 439058c. No specific kernel release is listed as fixed in the advisory, so all builds that compile the module without the bounds checks are vulnerable until the patch is applied.

The CVSS score for this flaw is 7.8, indicating high severity. EPSS data is not available, and the flaw has not yet appeared in the CISA KEV catalog. An exploit would require control over V4L2 AV1 controls, which typically means local or device-level access. On systems where the kernel allows untrusted users to set these controls, the risk of accidental or malicious kernel crashes or privilege escalation is elevated.