In the Linux kernel media subsystem, the Hantro HEVC driver performed a loop over the number of tiles defined by the PPS metadata and wrote information for each tile into a DMA buffer sized only for the maximum grid capacity defined by the user API. Because the loop was not bounded by the actual tile count helpers, an attacker could cause the driver to write beyond the allocated buffer, potentially corrupting kernel memory. The vendor has fixed the issue by replacing the size with the bounded helpers v4l2_hevc_pps_num_tile_columns() and v4l2_hevc_pps_num_tile_rows(), ensuring the loop stays inside the buffer limits.

The flaw affects the Linux kernel as a whole, specifically the media: verisilicon: hantro driver before the reported patch is vulnerable.

The exploit requires a local attacker able to interact with the Hantro V4L2 device, which typically needs elevated privileges to access media devices. The EPSS score of <1% indicates a very low probability of exploitation, and the vulnerability is not listed in the KEV catalog; the buffer overrun could lead to memory corruption, crashes, or potentially privilege escalation on a local system. The CVSS score of 5.5 denotes a medium severity risk. The vulnerability has been resolved in the kernel, and applying the patch removes the risk.