CVE-2026-97578media: verisilicon: rockchip: guard VPU981 AV1 divisor and tile buffer
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: media: verisilicon: rockchip: guard VPU981 AV1 divisor and tile buffer rockchip_vpu981_av1_dec_set_tile_info() divides context_update_tile_id by tile_info->tile_cols and writes one descriptor per tile into the tile_info DMA buffer, which holds AV1_MAX_TILES entries; tile_cols and tile_rows come from the bitstream. Guard the division against a zero tile_cols by initialising the context-update values to zero and computing them only when tile_cols is non-zero, and stop the descriptor writes once the tile_info buffer is full. The tile geometry written to the hardware registers is left unmodified; the per-dimension and total tile bounds are enforced by the control validation.
- CVSS
- 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 3, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 727a400686a2c0d25015c9e44916a59b72882f83 before 8659e5fc21a82e00fb2db1557f2e06f0fca06b90; 727a400686a2c0d25015c9e44916a59b72882f83 builds before 7baa7bb1b784c19170df8c99466fa412040eb431; 727a400686a2c0d25015c9e44916a59b72882f83 builds before 8f19d869a9f6800547c9ad7ebaf3b94f973dab50; 727a400686a2c0d25015c9e44916a59b72882f83 builds before 6b7a281a815ae7c5e7bb2aad039ffea9bc933157; from 727a400686a2c0d25015c9e44916a59b72882f83 before b84f6533a8ed2fd7b282fc7ab4b8efadc745a89c | CNA record |
References
- https://git.kernel.org/stable/c/8659e5fc21a82e00fb2db1557f2e06f0fca06b90
- https://git.kernel.org/stable/c/7baa7bb1b784c19170df8c99466fa412040eb431
- https://git.kernel.org/stable/c/8f19d869a9f6800547c9ad7ebaf3b94f973dab50
- https://git.kernel.org/stable/c/6b7a281a815ae7c5e7bb2aad039ffea9bc933157
- https://git.kernel.org/stable/c/b84f6533a8ed2fd7b282fc7ab4b8efadc745a89c
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.