All vulnerabilities
CVE-2026-97578

Linux: media: verisilicon: rockchip: guard VPU981 AV1 divisor and tile buffer

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
7.8High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.16%Chance of exploitation activity in the next 30 days, higher than 5% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in8659e5fc21a82e00fb2db1557f2e06f0fca06b90Also 7baa7bb1b784c19170df8c99466fa412040eb431, 8f19d869a9f6800547c9ad7ebaf3b94f973dab50 and 1 moreCVE List
Published25 Sep 2026Updated 19 Oct 2026CVE List

What fixes it

  • 8659e5fc21a82e00fb2db1557f2e06f0fca06b90LinuxCVE List
  • 7baa7bb1b784c19170df8c99466fa412040eb431LinuxCVE List
  • 8f19d869a9f6800547c9ad7ebaf3b94f973dab50LinuxCVE List
  • 6b7a281a815ae7c5e7bb2aad039ffea9bc933157LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

media: verisilicon: rockchip: guard VPU981 AV1 divisor and tile buffer

rockchip_vpu981_av1_dec_set_tile_info() divides context_update_tile_id by tile_info->tile_cols and writes one descriptor per tile into the tile_info DMA buffer, which holds AV1_MAX_TILES entries; tile_cols and tile_rows come from the bitstream. Guard the division against a zero tile_cols by initialising the context-update values to zero and computing them only when tile_cols is non-zero, and stop the descriptor writes once the tile_info buffer is full. The tile geometry written to the hardware registers is left unmodified; the per-dimension and total tile bounds are enforced by the control validation.

Text from CVE List

Affected versions 12

  • Linuxaffected: 727a400686a2c0d25015c9e44916a59b72882f83 before 8659e5fc21a82e00fb2db1557f2e06f0fca06b90CVE List
  • Linuxaffected: 727a400686a2c0d25015c9e44916a59b72882f83 before 7baa7bb1b784c19170df8c99466fa412040eb431CVE List
  • Linuxaffected: 727a400686a2c0d25015c9e44916a59b72882f83 before 8f19d869a9f6800547c9ad7ebaf3b94f973dab50CVE List
  • Linuxaffected: 727a400686a2c0d25015c9e44916a59b72882f83 before 6b7a281a815ae7c5e7bb2aad039ffea9bc933157CVE List
  • Linuxaffected: 727a400686a2c0d25015c9e44916a59b72882f83 before b84f6533a8ed2fd7b282fc7ab4b8efadc745a89cCVE List
  • Linuxaffected: 6.5CVE List
  • Linuxunaffected: all versions before 6.5CVE List
  • Linuxunaffected: 6.6.158 through 6.6.*CVE List
  • Linuxunaffected: 6.12.111 through 6.12.*CVE List
  • Linuxunaffected: 6.18.53 through 6.18.*CVE List
  • Linuxunaffected: 7.2.7 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 5