CVE-2026-97578
Received Received - Intake

Rockchip VPU981 AV1 Decoder Tile Buffer Overflow

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: media: verisilicon: rockchip: guard VPU981 AV1 divisor and tile buffer rockchip_vpu981_av1_dec_set_tile_info() divides context_update_tile_id by tile_info->tile_cols and writes one descriptor per tile into the tile_info DMA buffer, which holds AV1_MAX_TILES entries; tile_cols and tile_rows come from the bitstream. Guard the division against a zero tile_cols by initialising the context-update values to zero and computing them only when tile_cols is non-zero, and stop the descriptor writes once the tile_info buffer is full. The tile geometry written to the hardware registers is left unmodified; the per-dimension and total tile bounds are enforced by the control validation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-09-25
AI Q&A
2026-09-25
EPSS Evaluated
N/A
NVD
CVE-2026-97578
EUVD
EUVD-2026-86886

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
verisilicon rockchip *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves improper handling of tile information in the Rockchip VPU981 AV1 decoder. The function rockchip_vpu981_av1_dec_set_tile_info() divides a value by tile_cols without checking if it is zero, which could lead to a division by zero error. Additionally, it writes tile descriptors to a buffer without ensuring it has enough space, potentially causing buffer overflows.

Detection Guidance

This vulnerability is specific to the Linux kernel's media subsystem, particularly the VeriSilicon Rockchip VPU981 AV1 decoder. Detection requires checking kernel logs for errors related to VPU981 AV1 decoding or tile buffer overflows. Commands like dmesg | grep -i vpu981 or journalctl -k | grep -i vpu981 may help identify issues. Ensure your kernel version is updated to a patched release.

Impact Analysis

This vulnerability could cause system crashes or instability if exploited, as division by zero or buffer overflows may lead to kernel panics. It primarily affects systems using the Rockchip VPU981 AV1 decoder, potentially disrupting media processing tasks.

Mitigation Strategies

Update the Linux kernel to the latest stable version that includes the fix for this vulnerability. If using a Rockchip VPU981 device, verify that the firmware and drivers are updated. Disable AV1 decoding via the VPU981 if not required, or restrict access to untrusted bitstreams until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-97578. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart