CVE-2026-43310

media: verisilicon: Avoid G2 bus error while decoding H.264 and HEVC

MEDIUM
5.5
CVSS Score
Published: May 8, 2026 at 01:11 PM UTC
Updated: October 21, 2026 at 01:18 PM UTC
1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Severity
MEDIUM5.5
Exploit prediction
EPSS 0.1%

Description

In the Linux kernel, the following vulnerability has been resolved: media: verisilicon: Avoid G2 bus error while decoding H.264 and HEVC For the i.MX8MQ platform, there is a hardware limitation: the g1 VPU and g2 VPU cannot decode simultaneously; otherwise, it will cause below bus error and produce corrupted pictures, even potentially lead to system hang. [ 110.527986] hantro-vpu 38310000.video-codec: frame decode timed out. [ 110.583517] hantro-vpu 38310000.video-codec: bus error detected. Therefore, it is necessary to ensure that g1 and g2 operate alternately. This allows for successful multi-instance decoding of H.264 and HEVC. To achieve this, g1 and g2 share the same v4l2_m2m_dev, and then the v4l2_m2m_dev can handle the scheduling.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

5.14 ≤ v < 6.19.65.14cb5dd5a0fa518dff14ff2b90837c3c8f98f4dd5c
Vendor states this is fixed in 286d629d10640bc22f3bf46aa4f356eb7975e862 (fixed)
Vendor states this is fixed in e0203ddf9af7c8e170e1e99ce83b4dc07f0cd765 (fixed)
Vendor states this is fixed in 5.14 (unaffected)
Vendor states this is fixed in 6.12.114 (unaffected)
Vendor states this is fixed in 6.18.57 (unaffected)
Vendor states this is fixed in 6.19.6 (unaffected)
Vendor states this is fixed in 6.6.160 (unaffected)
Vendor states this is fixed in 7.0 (unaffected)

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

CVSS

Attack Vector
LOCAL
Complexity
LOW
Privileges
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
NONE
Availability
HIGH
Vector?

Quick Info

StatusMODIFIED
CWE
NVD-CWE-noinfo

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Free plan, no card