In the Linux kernel media subsystem, the Hantro HEVC driver performed a loop over the number of tiles defined by the PPS metadata and wrote information for each tile into a DMA buffer sized only for the maximum grid capacity defined by the user API. Because the loop was not bounded by the actual tile count helpers, an attacker could cause the driver to write beyond the allocated buffer, potentially corrupting kernel memory. The vendor has fixed the issue by replacing the size with the bounded helpers v4l2_hevc_pps_num_tile_columns() and v4l2_hevc_pps_num_tile_rows(), ensuring the loop stays inside the buffer limits.

The flaw affects the Linux kernel as a whole, specifically the media subsystem driver for Verisilicon Hantro hardware. No particular kernel release is listed, but any system running the media: verisilicon: hantro driver before the reported patch is vulnerable.

The exploit requires a local attacker able to interact with the Hantro V4L2 device, which typically needs elevated privileges to access media devices. The lack of an EPSS score and KEV listing means there is no current evidence of exploitation, but the buffer overrun could lead to memory corruption, crashes, or potentially privilege escalation on a local system. The vulnerability has been resolved in the kernel, and applying the patch removes the risk.