The kernel’s V4L2 stateless HEVC decoder reads tile counts from the num_tile_columns_minus1 and num_tile_rows_minus1 arrays but does not enforce bounds on these u8 values. An attacker who can influence a V4L2_CTRL_TYPE_HEVC_PPS structure with tiling enabled may supply excessively large tile counts that exceed the defined array capacity. The decoder will then use these out-of-bounds values as loop limits, potentially causing an out-of-bounds read of kernel memory or a crash, exposing sensitive data or leading to denial of service.

The affected component is the Linux kernel’s media subsystem (v4l2-ctrls). No specific kernel release or patch level is enumerated in the advisory; any kernel version still utilizing the stateless HEVC decoder without the described bounds check is susceptible. The vendor is Linux (Linux Kernel).

The CVSS severity score of 7.8 indicates a high risk, while the EPSS model provides no score, so the quantified risk remains uncertain. The vulnerability carries a high impact potential given that HEVC decoding is a common media operation. The attack likely requires local user or privileged access to supply a crafted HEVC stream to a V4L2 consumer; remote exploitation is uncertain. The advisory does not list this issue in the CISA KEV catalog, and no exploit is publicly known at this time.