All vulnerabilities
CVE-2026-97580

Linux: media: rkvdec: bound HEVC tile loops and PPS id to the array capacity

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
7.8High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.15%Chance of exploitation activity in the next 30 days, higher than 4% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in03beb248d8a7bab30559a60d4df81f167e63b9e3Also 81ad46bb33d8fd279aaa33af5296c648814c964bCVE List
Published25 Sep 2026Updated 19 Oct 2026CVE List

What fixes it

  • 03beb248d8a7bab30559a60d4df81f167e63b9e3LinuxCVE List
  • 81ad46bb33d8fd279aaa33af5296c648814c964bLinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

media: rkvdec: bound HEVC tile loops and PPS id to the array capacity

compute_tiles_uniform() and compute_tiles_non_uniform() loop over num_tile_columns_minus1 + 1 / num_tile_rows_minus1 + 1 entries, and assemble_hw_pps() writes one COLUMN_WIDTH / ROW_HEIGHT register per tile and indexes priv_tbl->param_set[] by pic_parameter_set_id, all taken from the untrusted PPS. Use the bounded v4l2_hevc_pps_num_tile_columns() / v4l2_hevc_pps_num_tile_rows() helpers for the tile loops, and bail out of assemble_hw_pps() before indexing priv_tbl->param_set[] with an out-of-range pic_parameter_set_id, so the writes stay within the hardware tables.

Text from CVE List

Affected versions 6

  • Linuxaffected: 3595375c2301653d5440d54b396df03499686c20 before 03beb248d8a7bab30559a60d4df81f167e63b9e3CVE List
  • Linuxaffected: 3595375c2301653d5440d54b396df03499686c20 before 81ad46bb33d8fd279aaa33af5296c648814c964bCVE List
  • Linuxaffected: 6.19CVE List
  • Linuxunaffected: all versions before 6.19CVE List
  • Linuxunaffected: 7.2.7 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 2