CVE-2026-97577
Received Received - Intake

Buffer Overflow in Linux Kernel AV1 Decoder

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: media: verisilicon: rockchip: reject AV1 frames exceeding the tile capacity rockchip_vpu981_av1_dec_set_tile_info() indexes the tile group entry array by tile1 * tile_cols + tile0, reading up to tile_cols * tile_rows entries, lays out one descriptor per tile in the AV1_MAX_TILES tile_info buffer, and programs the real tile_cols / tile_rows into the hardware. The tile group entry control is a dynamic array sized to the number of entries userspace submitted, independent of tile_cols / tile_rows, so a frame that claims more tiles than entries reads past the array. A frame that claims more than AV1_MAX_TILES tiles also leaves the hardware programmed for more tiles than the descriptor buffer holds. Reject both in prepare_run(): tile_cols * tile_rows must not exceed the submitted entry count or AV1_MAX_TILES. The entry count is read via v4l2_ctrl_find() (ctrl->elems). This mirrors the bound the mediatek AV1 decoder already enforces.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-09-25
AI Q&A
2026-09-25
EPSS Evaluated
N/A
NVD
CVE-2026-97577
EUVD
EUVD-2026-86885

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
verisilicon rockchip *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves improper handling of AV1 video frames in the Rockchip VPU981 decoder. The issue occurs when the decoder processes frames claiming more tiles than the hardware can handle or more than the allocated buffer space. This leads to out-of-bounds array reads and potential buffer overflows, which could cause memory corruption or crashes.

Detection Guidance

This vulnerability is specific to the Linux kernel's media subsystem, particularly the Rockchip VPU decoder for AV1 frames. Detection requires checking kernel logs for errors related to tile group entries or AV1 decoding failures. Commands like dmesg | grep -i av1 or journalctl -k | grep -i tile may help identify issues. Ensure your kernel version includes the fix.

Impact Analysis

If exploited, this vulnerability could allow an attacker to cause a denial-of-service (system crash) or potentially execute arbitrary code on a system using the affected Linux kernel with the Rockchip VPU981 AV1 decoder. Users may experience system instability or unexpected behavior when processing malicious AV1 video files.

Mitigation Strategies

Update your Linux kernel to a version that includes the fix for this vulnerability. If using a Rockchip VPU device, verify the kernel patch is applied. Avoid processing AV1 frames from untrusted sources until patched. Monitor vendor advisories for Rockchip or VeriSilicon hardware updates.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-97577. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart