CVE-2026-97577 in Linux
Summary
by MITRE • 09/25/2026
In the Linux kernel, the following vulnerability has been resolved:
media: verisilicon: rockchip: reject AV1 frames exceeding the tile capacity
rockchip_vpu981_av1_dec_set_tile_info() indexes the tile group entry array by tile1 * tile_cols + tile0, reading up to tile_cols * tile_rows entries, lays out one descriptor per tile in the AV1_MAX_TILES tile_info buffer, and programs the real tile_cols / tile_rows into the hardware.
The tile group entry control is a dynamic array sized to the number of entries userspace submitted, independent of tile_cols / tile_rows, so a frame that claims more tiles than entries reads past the array. A frame that claims more than AV1_MAX_TILES tiles also leaves the hardware programmed for more tiles than the descriptor buffer holds.
Reject both in prepare_run(): tile_cols * tile_rows must not exceed the submitted entry count or AV1_MAX_TILES. The entry count is read via v4l2_ctrl_find() (ctrl->elems). This mirrors the bound the mediatek AV1 decoder already enforces.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/25/2026
The vulnerability identified in the Linux kernel's media subsystem, specifically within the Rockchip VPU981 AV1 decoder driver, represents a critical out-of-bounds read and potential buffer overflow condition arising from insufficient validation of input parameters provided by userspace applications. The core technical flaw resides in the rockchip_vpu981_av1_dec_set_tile_info function, which is responsible for configuring tile group entries based on data received from user-space via the Video4Linux2 interface. AV1 decoding utilizes a tiling mechanism to allow parallel processing of different frame regions, where each tile requires specific descriptor information stored in hardware registers and software buffers. The driver constructs an index into a dynamic array using the formula tile1 multiplied by tile_cols plus tile0, effectively attempting to access up to tile_cols times tile_rows entries within this structure. However, the size of this control array is determined solely by the number of elements userspace explicitly submits through the v4l2_ctrl_find mechanism, rather than being strictly bound by the geometric dimensions declared in the frame header. This disconnect creates a scenario where malicious or malformed input can cause the driver to read memory beyond the allocated bounds of the tile group entry array if the product of tile_cols and tile_rows exceeds the submitted element count.
Beyond the immediate risk of reading out-of-bounds kernel memory, which could lead to information disclosure or stability issues such as kernel panics due to invalid pointer dereferences, there is a secondary hardware programming vulnerability. The driver also programs the actual number of tiles into the hardware decoder based on tile_cols and tile_rows without verifying that this count fits within the static AV1_MAX_TILES limit defined in the driver code. If a frame claims more tiles than AV1_MAX_TILES allows, the system attempts to write descriptor data for non-existent slots in the fixed-size buffer used by the hardware interface. This mismatch between the logical tile configuration and the physical capacity of the descriptor buffer can result in memory corruption within kernel space or undefined behavior in the video processing unit itself. Such conditions are particularly dangerous because they allow a local user with access to the media device node to potentially exploit these bounds checking failures, leading to privilege escalation if an attacker can leverage the resulting instability to execute arbitrary code or crash system services for denial of service purposes.
From a threat modeling perspective, this vulnerability aligns closely with CWE-125 Out-of-bounds Read and CWE-787 Out-of-bounds Write in cases where hardware register programming leads to memory corruption. It also reflects weaknesses associated with improper input validation typical of CWE-20 Improper Input Validation. In the context of the MITRE ATT&CK framework, this flaw facilitates techniques related to Local Privilege Escalation and Defense Evasion through exploitation of kernel vulnerabilities. The lack of strict boundary checks on dynamic array indexing based on external inputs is a common pattern in driver development that attackers frequently target. By submitting frames with artificially inflated tile dimensions, an attacker can trigger the out-of-bounds access repeatedly or craft specific payloads to manipulate memory layout for further exploitation steps such as heap spraying or arbitrary read/write primitives depending on the surrounding kernel state and architecture specifics.
The resolution implemented by rejecting AV1 frames that exceed either the submitted entry count or the maximum allowed tile limit in the prepare_run phase addresses these issues at a critical point before hardware configuration occurs. By enforcing that the product of tile_cols and tile_rows must not surpass both the dynamically allocated element count and the static AV1_MAX_TILES constant, the driver ensures that all subsequent array accesses remain within valid memory boundaries. This approach mirrors best practices observed in other media drivers such as those for MediaTek decoders, which already enforce similar bounds to prevent analogous vulnerabilities. The fix leverages standard V4L2 control mechanisms to retrieve and validate element counts, ensuring consistency across different hardware implementations while maintaining strict adherence to the declared capabilities of the decoder hardware.
To mitigate risks associated with this class of vulnerability in broader systems, it is essential for developers to implement rigorous input validation at all boundaries where external data influences internal buffer sizes or array indices. Specifically, any calculation involving dimensions provided by userspace must be cross-referenced against both dynamic allocation limits and static hardware constraints before being used for memory access or device configuration. Regular code audits focusing on media drivers and kernel subsystems that handle complex multimedia formats are recommended to identify similar patterns of unchecked arithmetic operations leading to buffer overflows. Additionally, employing fuzzing tools tailored for V4L2 interfaces can help uncover edge cases in tile parsing logic during the development lifecycle rather than relying solely on post-deployment patching. System administrators should ensure timely application of kernel updates that include these media driver fixes and monitor system logs for signs of instability or unauthorized access attempts targeting video processing devices.