CVE-2026-97578 in Linux
Summary
by MITRE • 09/25/2026
In the Linux kernel, the following vulnerability has been resolved:
media: verisilicon: rockchip: guard VPU981 AV1 divisor and tile buffer
rockchip_vpu981_av1_dec_set_tile_info() divides context_update_tile_id by tile_info->tile_cols and writes one descriptor per tile into the tile_info DMA buffer, which holds AV1_MAX_TILES entries; tile_cols and tile_rows come from the bitstream. Guard the division against a zero tile_cols by initialising the context-update values to zero and computing them only when tile_cols is non-zero, and stop the descriptor writes once the tile_info buffer is full. The tile geometry written to the hardware registers is left unmodified; the per-dimension and total tile bounds are enforced by the control validation.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/25/2026
The Linux kernel media subsystem contains a vulnerability within the Verisilicon Rockchip VPU981 AV1 decoder driver that stems from insufficient input validation of bitstream parameters, specifically regarding tile geometry. The function rockchip_vpu981_av1_dec_set_tile_info is responsible for processing tile information extracted from the decoded video stream to configure hardware descriptors. This process involves dividing a context update identifier by the number of tile columns derived directly from the external AV1 bitstream data. Because this value originates from untrusted input, it can be manipulated by an attacker crafting a malicious media file or network stream. The primary technical flaw is that the code does not verify whether the divisor, representing the column count, is zero before performing the division operation. In C programming and kernel execution environments, dividing by zero triggers a hardware exception, typically resulting in a page fault or general protection fault within the kernel space. This leads to an immediate crash of the affected process or, depending on kernel configuration and context, a complete system panic, effectively causing a denial of service against the device running the Linux operating system.
Beyond the arithmetic error, there is also a risk of buffer overflow if the number of tiles implied by the bitstream exceeds the capacity of the internal descriptor array. The tile_info DMA buffer is statically sized to hold AV1_MAX_TILES entries. If an attacker provides a malformed stream with a high count of rows and columns such that the total calculated tile count surpasses this limit, the loop writing descriptors into the buffer will continue past its allocated bounds. This out-of-bounds write can corrupt adjacent kernel memory structures, potentially leading to arbitrary code execution if the corrupted data includes function pointers or control flow metadata. Although the description notes that per-dimension and total tile bounds are enforced by control validation logic elsewhere in the pipeline, the specific division operation and descriptor writing loop lacked these safeguards at the point of hardware register configuration. This gap allows malformed inputs to trigger either a crash via division-by-zero or memory corruption via buffer overflow before higher-level validations might catch the anomaly.
The operational impact of this vulnerability is significant for any system utilizing Rockchip SoCs with VPU981 AV1 decoding capabilities, particularly in embedded devices, set-top boxes, and IoT appliances where media processing is a core function. A successful exploitation results in immediate service disruption through kernel panic or process termination. In scenarios involving remote media streaming services, an attacker could remotely trigger this condition by serving specially crafted video content, leading to widespread denial of service across affected endpoints. Furthermore, if the buffer overflow aspect can be reliably triggered and controlled, it opens the door for privilege escalation attacks where a local unprivileged user could exploit the memory corruption to gain kernel-level access. This aligns with common vulnerability classifications such as CWE-369 for divide-by-zero errors and CWE-120 or CWE-787 for buffer overflows involving out-of-bounds writes. From an ATT&CK perspective, this represents a technique often used in initial exploitation phases to destabilize target systems or escalate privileges through memory corruption techniques like heap spraying or structure overwrite.
Mitigation strategies focus on hardening the input validation logic within the driver code. The primary fix involves adding explicit checks for zero values before performing division operations involving user-controlled data, ensuring that context-update values are initialized to safe defaults when tile dimensions are invalid. Additionally, loop bounds must be strictly enforced against the maximum capacity of the descriptor buffer to prevent out-of-bounds writes regardless of the bitstream content. Developers should implement rigorous validation of all geometric parameters extracted from media streams before they are passed to hardware configuration functions. For system administrators and users, applying kernel updates that include this patch is critical. Since this vulnerability resides in a specific driver module, ensuring that the Linux kernel version on affected devices includes these security patches will neutralize the risk. Regular auditing of media processing drivers for similar patterns of unchecked arithmetic operations against external inputs is also recommended to prevent analogous vulnerabilities in other subsystems.