From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-cve-announce@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@kernel.org>
Subject: CVE-2026-97577: media: verisilicon: rockchip: reject AV1 frames exceeding the tile capacity
Date: Fri, 25 Sep 2026 12:22:37 +0200 [thread overview]
Message-ID: <2026092555-CVE-2026-97577-e1f2@gregkh> (raw)
From: Greg Kroah-Hartman <gregkh@kernel.org>
Description
===========
In the Linux kernel, the following vulnerability has been resolved:
media: verisilicon: rockchip: reject AV1 frames exceeding the tile capacity
rockchip_vpu981_av1_dec_set_tile_info() indexes the tile group entry
array by tile1 * tile_cols + tile0, reading up to tile_cols * tile_rows
entries, lays out one descriptor per tile in the AV1_MAX_TILES tile_info
buffer, and programs the real tile_cols / tile_rows into the hardware.
The tile group entry control is a dynamic array sized to the number of
entries userspace submitted, independent of tile_cols / tile_rows, so a
frame that claims more tiles than entries reads past the array. A frame
that claims more than AV1_MAX_TILES tiles also leaves the hardware
programmed for more tiles than the descriptor buffer holds.
Reject both in prepare_run(): tile_cols * tile_rows must not exceed the
submitted entry count or AV1_MAX_TILES. The entry count is read via
v4l2_ctrl_find() (ctrl->elems). This mirrors the bound the mediatek AV1
decoder already enforces.
The Linux kernel CVE team has assigned CVE-2026-97577 to this issue.
Affected and fixed versions
===========================
Issue introduced in 6.5 with commit 727a400686a2c0d25015c9e44916a59b72882f83 and fixed in 6.12.111 with commit 40029f7f35397853f8711d6fce1d90a4c7a01f8c
Issue introduced in 6.5 with commit 727a400686a2c0d25015c9e44916a59b72882f83 and fixed in 6.18.53 with commit a41babf528f70c9a82ed31cfb5fe19065910f7f0
Issue introduced in 6.5 with commit 727a400686a2c0d25015c9e44916a59b72882f83 and fixed in 7.2.7 with commit fd965369220cc160bb20a24991790814bfbab401
Issue introduced in 6.5 with commit 727a400686a2c0d25015c9e44916a59b72882f83 and fixed in 7.3-rc3 with commit 367db8b23c26a913d76ed70457bbcd781c422b49
Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.
Unaffected versions might change over time as fixes are backported to
older supported kernel versions. The official CVE entry at
https://cve.org/CVERecord/?id=CVE-2026-97577
will be updated if fixes are backported, please check that for the most
up to date information about this issue.
Affected files
==============
The file(s) affected by this issue are:
drivers/media/platform/verisilicon/rockchip_vpu981_hw_av1_dec.c
Mitigation
==========
The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes. Individual
changes are never tested alone, but rather are part of a larger kernel
release. Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all. If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
https://git.kernel.org/stable/c/40029f7f35397853f8711d6fce1d90a4c7a01f8c
https://git.kernel.org/stable/c/a41babf528f70c9a82ed31cfb5fe19065910f7f0
https://git.kernel.org/stable/c/fd965369220cc160bb20a24991790814bfbab401
https://git.kernel.org/stable/c/367db8b23c26a913d76ed70457bbcd781c422b49
reply other threads:[~2026-09-25 10:27 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=2026092555-CVE-2026-97577-e1f2@gregkh \
--to=gregkh@linuxfoundation.org \
--cc=cve@kernel.org \
--cc=gregkh@kernel.org \
--cc=linux-cve-announce@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.