All vulnerabilities
CVE-2026-97577

Linux: media: verisilicon: rockchip: reject AV1 frames exceeding the tile capacity

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
7.8High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.16%Chance of exploitation activity in the next 30 days, higher than 5% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in95ee48eb17c91bd4859b65e0a54e7722f370d0e5Also 40029f7f35397853f8711d6fce1d90a4c7a01f8c, 367db8b23c26a913d76ed70457bbcd781c422b49CVE List
Published25 Sep 2026Updated 19 Oct 2026CVE List

What fixes it

  • 95ee48eb17c91bd4859b65e0a54e7722f370d0e5LinuxCVE List
  • 40029f7f35397853f8711d6fce1d90a4c7a01f8cLinuxCVE List
  • 367db8b23c26a913d76ed70457bbcd781c422b49LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

media: verisilicon: rockchip: reject AV1 frames exceeding the tile capacity

rockchip_vpu981_av1_dec_set_tile_info() indexes the tile group entry array by tile1 * tile_cols + tile0, reading up to tile_cols * tile_rows entries, lays out one descriptor per tile in the AV1_MAX_TILES tile_info buffer, and programs the real tile_cols / tile_rows into the hardware.

The tile group entry control is a dynamic array sized to the number of entries userspace submitted, independent of tile_cols / tile_rows, so a frame that claims more tiles than entries reads past the array. A frame that claims more than AV1_MAX_TILES tiles also leaves the hardware programmed for more tiles than the descriptor buffer holds.

Reject both in prepare_run(): tile_cols * tile_rows must not exceed the submitted entry count or AV1_MAX_TILES. The entry count is read via v4l2_ctrl_find() (ctrl->elems). This mirrors the bound the mediatek AV1 decoder already enforces.

Text from CVE List

Affected versions 12

  • Linuxaffected: 727a400686a2c0d25015c9e44916a59b72882f83 before 95ee48eb17c91bd4859b65e0a54e7722f370d0e5CVE List
  • Linuxaffected: 727a400686a2c0d25015c9e44916a59b72882f83 before 40029f7f35397853f8711d6fce1d90a4c7a01f8cCVE List
  • Linuxaffected: 727a400686a2c0d25015c9e44916a59b72882f83 before a41babf528f70c9a82ed31cfb5fe19065910f7f0CVE List
  • Linuxaffected: 727a400686a2c0d25015c9e44916a59b72882f83 before fd965369220cc160bb20a24991790814bfbab401CVE List
  • Linuxaffected: 727a400686a2c0d25015c9e44916a59b72882f83 before 367db8b23c26a913d76ed70457bbcd781c422b49CVE List
  • Linuxaffected: 6.5CVE List
  • Linuxunaffected: all versions before 6.5CVE List
  • Linuxunaffected: 6.6.158 through 6.6.*CVE List
  • Linuxunaffected: 6.12.111 through 6.12.*CVE List
  • Linuxunaffected: 6.18.53 through 6.18.*CVE List
  • Linuxunaffected: 7.2.7 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 5