CVE-2026-97579 in Linux
Summary
by MITRE • 09/25/2026
In the Linux kernel, the following vulnerability has been resolved:
media: mediatek: vcodec: bound AV1 tile-start copy to the array capacity
vdec_av1_slice_setup_tile() copies tile_cols + 1 / tile_rows + 1 entries into mi_col_starts[] / mi_row_starts[] from the bitstream tile_info. Bound
the copy to the array capacity.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/25/2026
The Linux kernel media subsystem, specifically within the MediaTek video codec driver for AV1 decoding, contained a critical buffer over-read vulnerability in the slice setup logic. This flaw was located in the vdec_av1_slice_setup_tile function, which is responsible for parsing tile information from the incoming bitstream to configure the decoder state. The specific issue arises when the driver copies data regarding column and row start indices into internal arrays named mi_col_starts and mi_row_starts. These arrays have a fixed maximum capacity defined by hardware or software constraints inherent to the MediaTek video processing unit. However, prior to this fix, the code performed an unbounded copy operation based directly on values extracted from the AV1 bitstream tile_info structure without verifying that these values did not exceed the allocated array limits.
This lack of bounds checking creates a scenario where a maliciously crafted or corrupted media file can trigger a buffer over-read condition. When the tile_cols_plus_one and tile_rows_plus_one fields in the bitstream contain values larger than what the mi_col_starts and mi_row_starts arrays can accommodate, the copy operation reads beyond the end of these kernel-space buffers. While this specific instance is described as an over-read rather than a write overflow, it still poses significant security risks. Reading out-of-bounds memory allows an attacker to potentially leak sensitive information from adjacent kernel memory regions into the application space or cause undefined behavior that could lead to system instability. In some contexts, such memory access violations can be leveraged for denial of service attacks by causing kernel panics or crashes when accessing unmapped pages.
The operational impact of this vulnerability is primarily related to the integrity and stability of systems utilizing MediaTek hardware acceleration for AV1 video playback. Since media processing often involves handling untrusted content from various sources such as web browsers, streaming applications, or file storage, an attacker could exploit this flaw by providing a specially constructed video stream. Successful exploitation does not necessarily require local access if the vulnerability is reachable through networked services that process media files, although it is most commonly associated with local privilege escalation or denial of service via user-space applications triggering kernel faults. The presence of such flaws in hardware-accelerated decoding paths highlights the complexity and risk involved in integrating third-party bitstream parsers into the core operating system.
To mitigate this vulnerability, the primary remediation involves applying the upstream Linux kernel patch that introduces explicit bounds checking before performing the memory copy operations. Developers must ensure that tile_cols_plus_one and tile_rows_plus_one are validated against the maximum allowed dimensions for mi_col_starts and mi_row_starts respectively. If these values exceed the array capacity, the decoder should reject the slice or handle it gracefully rather than proceeding with an unsafe memory access. For system administrators and users, this issue is resolved by updating to a kernel version that includes this specific media driver fix. Regularly maintaining up-to-date kernel packages ensures protection against such parsing errors in hardware acceleration drivers.
From a classification perspective, this vulnerability aligns with CWE-126 Buffer Over-read, which describes the act of reading past the end of a buffer due to insufficient bounds checking on input data derived from external sources like bitstreams. In terms of attack vectors and techniques, this flaw relates to ATT&CK technique T1059 Command and Scripting Interpreter if exploited for further execution, but more directly it falls under initial access or privilege escalation pathways where malformed inputs are used to destabilize the system. The fix emphasizes the importance of strict input validation in kernel-space drivers that process complex binary formats like AV1, ensuring that all array indices derived from external data are rigorously validated against static allocation limits before any memory operations occur.