In the Linux kernel, the following vulnerability has been resolved: media: verisilicon: AV1: Fix tile info buffer size Each tile info is composed of: row_sb, col_sb, start_pos and end_pos (4 bytes each). So the total required memory is AV1_MAX_TILES * 16 bytes. Use the correct #define to allocate the buffer and avoid writing tile info in non-allocated memory.

A flaw was found in the Linux kernel's media: verisilicon: AV1 driver. The driver incorrectly calculates the buffer size for tile information, which can lead to writing data beyond the allocated memory. This memory corruption vulnerability could result in system instability or a denial of service.

Red Hat Enterprise Linux 10 Not affected kernel Red Hat Enterprise Linux 6 Not affected kernel Red Hat Enterprise Linux 7 Not affected kernel Red Hat Enterprise Linux 7 Not affected kernel-rt Red Hat Enterprise Linux 8 Not affected kernel Red Hat Enterprise Linux 8 Not affected kernel-rt Red Hat Enterprise Linux 9 Not affected kernel Red Hat Enterprise Linux 9 Not affected kernel-rt https://www.cve.org/CVERecord?id=CVE-2026-43222 https://nvd.nist.gov/vuln/detail/CVE-2026-43222 https://lore.kernel.org/linux-cve-announce/2026050653-CVE-2026-43222-3676@gregkh/T