Linux Kernel up to 7.2.6/7.3-rc2 rkvdec pic_parameter_set_id out-of-bounds write

Summaryinfo

A vulnerability labeled as very critical has been found in Linux Kernel up to 7.2.6/7.3-rc2. This impacts the function compute_tiles_uniform/compute_tiles_non_uniform/assemble_hw_pps of the component rkvdec. Executing a manipulation of the argument pic_parameter_set_id can lead to out-of-bounds write. This vulnerability is handled as CVE-2026-97580. The attack can be executed remotely. There is not any exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in Linux Kernel up to 7.2.6/7.3-rc2. It has been declared as very critical. This vulnerability affects the function compute_tiles_uniform/compute_tiles_non_uniform/assemble_hw_pps of the component rkvdec. The manipulation of the argument pic_parameter_set_id with an unknown input leads to a out-of-bounds write vulnerability. The CWE definition for the vulnerability is CWE-787. The product writes data past the end, or before the beginning, of the intended buffer. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

In the Linux kernel, the following vulnerability has been resolved: media: rkvdec: bound HEVC tile loops and PPS id to the array capacity compute_tiles_uniform() and compute_tiles_non_uniform() loop over num_tile_columns_minus1 + 1 / num_tile_rows_minus1 + 1 entries, and assemble_hw_pps() writes one COLUMN_WIDTH / ROW_HEIGHT register per tile and indexes priv_tbl->param_set[] by pic_parameter_set_id, all taken from the untrusted PPS. Use the bounded v4l2_hevc_pps_num_tile_columns() / v4l2_hevc_pps_num_tile_rows() helpers for the tile loops, and bail out of assemble_hw_pps() before indexing priv_tbl->param_set[] with an out-of-range pic_parameter_set_id, so the writes stay within the hardware tables.

The advisory is shared for download at git.kernel.org. This vulnerability was named CVE-2026-97580 since 09/24/2026. The exploitation appears to be easy. The attack can be initiated remotely. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $5k-$25k (estimation calculated on 09/25/2026).

Upgrading to version 7.2.7 or 7.3-rc3 eliminates this vulnerability. Applying the patch 03beb248d8a7bab30559a60d4df81f167e63b9e3/81ad46bb33d8fd279aaa33af5296c648814c964b is able to eliminate this problem. The best possible mitigation is suggested to be upgrading to the latest version.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 7.2.0
• 7.2.1
• 7.2.2
• 7.2.3
• 7.2.4
• 7.2.5
• 7.2.6
• 7.3-rc1
• 7.3-rc2

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion