CVE-2026-43310 media: verisilicon: Avoid G2 bus error while decoding H.264 and HEVC
Concurrent H.264/HEVC decoding on i.MX8MQ causes bus errors and system hangs, requiring kernel patching to prevent denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-43310?
CVE-2026-43310 is a medium-severity denial of service vulnerability in Linux kernel, published on 8 May 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
media: verisilicon: Avoid G2 bus error while decoding H.264 and HEVC
For the i.MX8MQ platform, there is a hardware limitation: the g1 VPU and g2 VPU cannot decode simultaneously; otherwise, it will cause below bus error and produce corrupted pictures, even potentially lead to system hang.
[ 110.527986] hantro-vpu 38310000.video-codec: frame decode timed out. [ 110.583517] hantro-vpu 38310000.video-codec: bus error detected.
Therefore, it is necessary to ensure that g1 and g2 operate alternately. This allows for successful multi-instance decoding of H.264 and HEVC.
To achieve this, g1 and g2 share the same v4l2_m2m_dev, and then the v4l2_m2m_dev can handle the scheduling.
Which versions are affected by CVE-2026-43310?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-43310?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-43310 being exploited?
There is no known exploitation of CVE-2026-43310 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-43310, DEBIAN-CVE-2026-43310, GHSA-6g88-27p6-cw4p, ROOT-OS-DEBIAN-12-CVE-2026-43310, ROOT-OS-DEBIAN-13-CVE-2026-43310, ROOT-OS-UBUNTU-2204-CVE-2026-43310 and 2 more.