CVE-2026-97579media: mediatek: vcodec: bound AV1 tile-start copy to the array capacity
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: media: mediatek: vcodec: bound AV1 tile-start copy to the array capacity vdec_av1_slice_setup_tile() copies tile_cols + 1 / tile_rows + 1 entries into mi_col_starts[] / mi_row_starts[] from the bitstream tile_info. Bound the copy to the array capacity.
- CVSS
- 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 3, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 0934d37596151edce115c6d0843a9ad7d5e5d232 before f19acf00818a9eada06a77715d0188c181fb435e; from 0934d37596151edce115c6d0843a9ad7d5e5d232 before ad47a250afafa3a51cfb4a004463ff28e66c596e; from 0934d37596151edce115c6d0843a9ad7d5e5d232 before 7992059c045780095ba5a696dcb2f5400a82803c; from 0934d37596151edce115c6d0843a9ad7d5e5d232 before eb0ea3898e3921900939e30c3946dd2b52281859; 0934d37596151edce115c6d0843a9ad7d5e5d232 builds before 37bef2170d4c88fc3d708eecf3ef0f4032bc1372 | CNA record |
References
- https://git.kernel.org/stable/c/f19acf00818a9eada06a77715d0188c181fb435e
- https://git.kernel.org/stable/c/ad47a250afafa3a51cfb4a004463ff28e66c596e
- https://git.kernel.org/stable/c/7992059c045780095ba5a696dcb2f5400a82803c
- https://git.kernel.org/stable/c/eb0ea3898e3921900939e30c3946dd2b52281859
- https://git.kernel.org/stable/c/37bef2170d4c88fc3d708eecf3ef0f4032bc1372
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.