CVE-2026-43310

CVE-2026-43310

Medium · published May 8, 2026

CVSS v3.1
5.5
EPSS
0%
Percentile
5.0
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

media: verisilicon: Avoid G2 bus error while decoding H.264 and HEVC

For the i.MX8MQ platform, there is a hardware limitation: the g1 VPU and

g2 VPU cannot decode simultaneously; otherwise, it will cause below bus

error and produce corrupted pictures, even potentially lead to system hang.

[ 110.527986] hantro-vpu 38310000.video-codec: frame decode timed out.

[ 110.583517] hantro-vpu 38310000.video-codec: bus error detected.

Therefore, it is necessary to ensure that g1 and g2 operate alternately.

This allows for successful multi-instance decoding of H.264 and HEVC.

To achieve this, g1 and g2 share the same v4l2_m2m_dev, and then the

v4l2_m2m_dev can handle the scheduling.

The record
Technical detail
CVSS v3.1
5.5 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00162 · 5.0th percentile
Published
2026-05-08T18:16Z
Affected products (1)
ProductVersionsFixed in
linux/linux_kernel≥ 5.14, < 6.19.66.19.6
References (5)
EPSS history
Timeline
  • 08 MAY 13:11Z
    media: verisilicon: Avoid G2 bus error while decoding H.264 and HEVC
    cvelistv5