All vulnerabilities
CVE-2026-97579

Linux: media: mediatek: vcodec: bound AV1 tile-start copy to the array capacity

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
7.8High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.16%Chance of exploitation activity in the next 30 days, higher than 5% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in7992059c045780095ba5a696dcb2f5400a82803cAlso 37bef2170d4c88fc3d708eecf3ef0f4032bc1372CVE List
Published25 Sep 2026Updated 19 Oct 2026CVE List

What fixes it

  • 7992059c045780095ba5a696dcb2f5400a82803cLinuxCVE List
  • 37bef2170d4c88fc3d708eecf3ef0f4032bc1372LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

media: mediatek: vcodec: bound AV1 tile-start copy to the array capacity

vdec_av1_slice_setup_tile() copies tile_cols + 1 / tile_rows + 1 entries into mi_col_starts[] / mi_row_starts[] from the bitstream tile_info. Bound the copy to the array capacity.

Text from CVE List

Affected versions 12

  • Linuxaffected: 0934d37596151edce115c6d0843a9ad7d5e5d232 before f19acf00818a9eada06a77715d0188c181fb435eCVE List
  • Linuxaffected: 0934d37596151edce115c6d0843a9ad7d5e5d232 before ad47a250afafa3a51cfb4a004463ff28e66c596eCVE List
  • Linuxaffected: 0934d37596151edce115c6d0843a9ad7d5e5d232 before 7992059c045780095ba5a696dcb2f5400a82803cCVE List
  • Linuxaffected: 0934d37596151edce115c6d0843a9ad7d5e5d232 before eb0ea3898e3921900939e30c3946dd2b52281859CVE List
  • Linuxaffected: 0934d37596151edce115c6d0843a9ad7d5e5d232 before 37bef2170d4c88fc3d708eecf3ef0f4032bc1372CVE List
  • Linuxaffected: 6.6CVE List
  • Linuxunaffected: all versions before 6.6CVE List
  • Linuxunaffected: 6.6.158 through 6.6.*CVE List
  • Linuxunaffected: 6.12.111 through 6.12.*CVE List
  • Linuxunaffected: 6.18.53 through 6.18.*CVE List
  • Linuxunaffected: 7.2.7 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 5