From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id AFE57490C02 for ; Fri, 25 Sep 2026 10:27:22 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790332043; cv=none; b=RFk98AlANc+YNMtf1bx1KHy2+FI97IYvmDg8xkkqiikWplCsOtH3U6KpG8mruYQM0vHOQVm1VcO2gLY2wLXRnw27DlPWeFh29T2LIVblPbejbGjnA0B7PYmt1L5ipBGakS78bwU+KlIsr82WDZbkmvJFWVIhBGydlRl1AkT/9bQ= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790332043; c=relaxed/simple; bh=au+SucsnDpkxwj6RnSuusByqW9vAy39aMkKAWJ/F5BM=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=IwVCIIQNm9IuNOx8okd/bp/OkBpoHd/8VehJfSrNa0xCI4GTsC54Mr6KmTsZwskOp2edmw+c62RBTa/uPcUqX8SQVBPURqfxTTZEWOhAHmEgux/XHZsiJ2gIoMEdDQQss0eSaEuIu9vM2Mcoc23qbEzuuLww+6iCcGsIiudVxsw= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=aqsJBXEU; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="aqsJBXEU" Received: by smtp.kernel.org (Postfix) with ESMTPSA id AE2271F00893; Fri, 25 Sep 2026 10:27:21 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1790332042; bh=KcF5yY62bqI5yHFxLGqh/syQ9zKLhGYGYWrfTMk7hEc=; h=From:To:Cc:Subject:Date:Reply-To; b=aqsJBXEUtZVwKFdHp3ejx7ojr4wWe7Ou6J5z94uHnAIz3ILZUIPVZ+WGObfE86QQN bv21x4X9fwcMS5pSyN7wb9LKUohuaqATyeNDIjsmfLJI0Wzenxf+vy81XLs6Txx3g1 XuO4GRIr/kIsKIReEC0FWastC/jhdS30Pmu6C6g0= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-97577: media: verisilicon: rockchip: reject AV1 frames exceeding the tile capacity Date: Fri, 25 Sep 2026 12:22:37 +0200 Message-ID: <2026092555-CVE-2026-97577-e1f2@gregkh> X-Mailer: git-send-email 2.55.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=3159; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=UORKDKmL02cs1rSrUdvzzWxhSu6S9d0LlHDR67DeJBY=; b=owGbwMvMwCRo6H6F97bub03G02pJDFnbvJ1fqmQfYixmMTYMO98UoNG+VELf7z+/g3hCyKKUI s/Zxb86YlkYBJkYZMUUWb5s4zm6v+KQopeh7WmYOaxMIEMYuDgFYCJHrzIsaFnGNV9Ra9mioyaC Lv/eTpSedSpUg2F+7R0135WHld5rCGZMuTQnoL3hZsIbAA== X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: media: verisilicon: rockchip: reject AV1 frames exceeding the tile capacity rockchip_vpu981_av1_dec_set_tile_info() indexes the tile group entry array by tile1 * tile_cols + tile0, reading up to tile_cols * tile_rows entries, lays out one descriptor per tile in the AV1_MAX_TILES tile_info buffer, and programs the real tile_cols / tile_rows into the hardware. The tile group entry control is a dynamic array sized to the number of entries userspace submitted, independent of tile_cols / tile_rows, so a frame that claims more tiles than entries reads past the array. A frame that claims more than AV1_MAX_TILES tiles also leaves the hardware programmed for more tiles than the descriptor buffer holds. Reject both in prepare_run(): tile_cols * tile_rows must not exceed the submitted entry count or AV1_MAX_TILES. The entry count is read via v4l2_ctrl_find() (ctrl->elems). This mirrors the bound the mediatek AV1 decoder already enforces. The Linux kernel CVE team has assigned CVE-2026-97577 to this issue. Affected and fixed versions =========================== Issue introduced in 6.5 with commit 727a400686a2c0d25015c9e44916a59b72882f83 and fixed in 6.12.111 with commit 40029f7f35397853f8711d6fce1d90a4c7a01f8c Issue introduced in 6.5 with commit 727a400686a2c0d25015c9e44916a59b72882f83 and fixed in 6.18.53 with commit a41babf528f70c9a82ed31cfb5fe19065910f7f0 Issue introduced in 6.5 with commit 727a400686a2c0d25015c9e44916a59b72882f83 and fixed in 7.2.7 with commit fd965369220cc160bb20a24991790814bfbab401 Issue introduced in 6.5 with commit 727a400686a2c0d25015c9e44916a59b72882f83 and fixed in 7.3-rc3 with commit 367db8b23c26a913d76ed70457bbcd781c422b49 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-97577 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/media/platform/verisilicon/rockchip_vpu981_hw_av1_dec.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/40029f7f35397853f8711d6fce1d90a4c7a01f8c https://git.kernel.org/stable/c/a41babf528f70c9a82ed31cfb5fe19065910f7f0 https://git.kernel.org/stable/c/fd965369220cc160bb20a24991790814bfbab401 https://git.kernel.org/stable/c/367db8b23c26a913d76ed70457bbcd781c422b49