Linux Kernel EUVD-2026-86883

Requires local access to a Video4Linux2 mem2mem device backed by a driver that implements a stateless AV1 decoder (submits V4L2_CTRL_TYPE_AV1_FRAME controls) - typically membership in the 'video' group and presence of AV1 hardware/decoder support, which is uncommon. The attacker must submit a control whose tile_info.tile_cols or tile_rows exceeds V4L2_AV1_MAX_TILE_COLS/_ROWS, or whose product exceeds V4L2_AV1_MAX_TILE_COUNT, and a consuming driver must process it. Limiting factors: no network vector (AV:L), authentication/local privilege required (PR:L), no default-config remote exposure, and the affected code path exists only on kernels 6.5 through the fixed stable releases with AV1 stateless decode enabled. Zero tile counts remain accepted (to preserve existing userspace), so only out-of-range values trigger the rejection/hardening.

This is a local, config/access-gated memory-safety bug in the Linux kernel V4L2 control framework, not a network-exploitable issue. The NVD CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/C:H/I:H/A:H) rates it as HIGH with full confidentiality/integrity/availability impact, but that overstates realistic risk: the flaw is a missing bounds check on attacker-supplied AV1 tile counts consumed by stateless AV1 decoder drivers, and the dominant outcome is out-of-bounds array access leading to memory corruption and a kernel crash (DoS) rather than reliable C:H/I:H code execution. No EPSS score, no CISA KEV listing, and no public exploit are present in the input, so there is no signal of active or imminent exploitation. Exploitation additionally requires local access to a V4L2 mem2mem device that actually implements a stateless AV1 decoder - a niche hardware/driver path - which further constrains real-world reach. My independent assessment lands around 5.0 (AV:L/AC:H/PR:L/C:N/I:L/A:H). Net: a legitimate kernel hardening fix worth patching in normal cycles, but a low real-world priority compared to its 7.8 label; treat C:H/I:H claims with skepticism absent an exploitation writeup.

A local user with access to a V4L2 stateless AV1 decoder device (/dev/videoN, typically the 'video' group) submits a crafted V4L2_CTRL_TYPE_AV1_FRAME control whose tile_cols/tile_rows (or their product) exceed the AV1 tile maxima. The unvalidated values are used as loop bounds and array indices into the decoder's mi_*_starts[]/*_in_sbs_minus_1[] structures and to size per-tile descriptor buffers, causing out-of-bounds access and a kernel crash or memory corruption. No public exploit code was identified at time of analysis; attack complexity is elevated by the need for a specific decoder-capable device and carefully crafted control values.