Linux Kernel EUVD-2026-86884

Requires (1) local access to a system with a V4L2 stateless HEVC decoder driver and device node (typically ARM/SoC hardware codecs, often gated behind the 'video' group or equivalent, hence PR:L), and (2) the ability to submit a V4L2_CTRL_TYPE_HEVC_PPS compound control via VIDIOC_S_EXT_CTRLS with tiling enabled and num_tile_columns_minus1/num_tile_rows_minus1 values whose resulting counts exceed the uAPI array capacity. Not exploitable remotely and not against systems lacking a stateless HEVC decoder; user interaction is not required beyond the attacker's own ioctl call.

The provided CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 7.8) correctly captures this as a LOCAL, authenticated (PR:L) issue requiring access to a V4L2 device node - it is NOT remotely reachable. The C:H/I:H/A:H impact triple appears overstated: the root cause is an unbounded u8 tile count (num_tile_columns_minus1+1 / num_tile_rows_minus1+1) used as a loop bound to read column_width_minus1[]/row_height_minus1[] beyond their uAPI array capacity - an out-of-bounds READ used as decode parameters, which is crash-dominant with at most limited adjacent-memory leakage, not full confidentiality/integrity/availability compromise. A more defensible assessment is roughly AV:L/AC:L/PR:L with C:N/I:L/A:H (~5.x). No EPSS score, no CISA KEV listing, and no public POC are present in the input, and there is no SSVC decision data. Signals are consistent (local vector, no exploitation evidence): this is a defensive hardening fix, not an urgent priority. Note the 'Information Disclosure' tag partially aligns with the OOB-read nature but the realistic dominant outcome is a kernel crash (DoS).

A local user with permission to open a stateless HEVC decoder V4L2 device (e.g. /dev/videoX, typically the 'video' group) issues VIDIOC_S_EXT_CTRLS to set a V4L2_CTRL_TYPE_HEVC_PPS control with tiling enabled and tile column/row counts exceeding the fixed uAPI array capacity. Because std_validate_compound() did not bound these counts pre-patch, the decoder tile loops read past column_width_minus1[]/row_height_minus1[], causing an out-of-bounds read and likely kernel crash. No public exploit code is identified at time of analysis.