CVE-2026-97577: media: verisilicon: rockchip: reject AV1 frames exceeding the tile capacity

CVE-2026-97577: media: verisilicon: rockchip: reject AV1 frames exceeding the tile capacity

[Greg Kroah-Hartman]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

media: verisilicon: rockchip: reject AV1 frames exceeding the tile capacity

rockchip_vpu981_av1_dec_set_tile_info() indexes the tile group entry
array by tile1 * tile_cols + tile0, reading up to tile_cols * tile_rows
entries, lays out one descriptor per tile in the AV1_MAX_TILES tile_info
buffer, and programs the real tile_cols / tile_rows into the hardware.

The tile group entry control is a dynamic array sized to the number of
entries userspace submitted, independent of tile_cols / tile_rows, so a
frame that claims more tiles than entries reads past the array. A frame
that claims more than AV1_MAX_TILES tiles also leaves the hardware
programmed for more tiles than the descriptor buffer holds.

Reject both in prepare_run(): tile_cols * tile_rows must not exceed the
submitted entry count or AV1_MAX_TILES. The entry count is read via
v4l2_ctrl_find() (ctrl->elems). This mirrors the bound the mediatek AV1
decoder already enforces.

The Linux kernel CVE team has assigned CVE-2026-97577 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 6.5 with commit 727a400686a2c0d25015c9e44916a59b72882f83 and fixed in 6.12.111 with commit 40029f7f35397853f8711d6fce1d90a4c7a01f8c
	Issue introduced in 6.5 with commit 727a400686a2c0d25015c9e44916a59b72882f83 and fixed in 6.18.53 with commit a41babf528f70c9a82ed31cfb5fe19065910f7f0
	Issue introduced in 6.5 with commit 727a400686a2c0d25015c9e44916a59b72882f83 and fixed in 7.2.7 with commit fd965369220cc160bb20a24991790814bfbab401
	Issue introduced in 6.5 with commit 727a400686a2c0d25015c9e44916a59b72882f83 and fixed in 7.3-rc3 with commit 367db8b23c26a913d76ed70457bbcd781c422b49

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-97577
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/media/platform/verisilicon/rockchip_vpu981_hw_av1_dec.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/40029f7f35397853f8711d6fce1d90a4c7a01f8c
	https://git.kernel.org/stable/c/a41babf528f70c9a82ed31cfb5fe19065910f7f0
	https://git.kernel.org/stable/c/fd965369220cc160bb20a24991790814bfbab401
	https://git.kernel.org/stable/c/367db8b23c26a913d76ed70457bbcd781c422b49