{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2026-97580", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-24T16:01:01.156Z", "datePublished": "2026-09-25T10:22:01.832Z", "dateUpdated": "2026-10-19T09:09:42.749Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:09:42.749Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: rkvdec: bound HEVC tile loops and PPS id to the array capacity\n\ncompute_tiles_uniform() and compute_tiles_non_uniform() loop over\nnum_tile_columns_minus1 + 1 / num_tile_rows_minus1 + 1 entries, and\nassemble_hw_pps() writes one COLUMN_WIDTH / ROW_HEIGHT register per tile\nand indexes priv_tbl->param_set[] by pic_parameter_set_id, all taken from\nthe untrusted PPS. Use the bounded v4l2_hevc_pps_num_tile_columns() /\nv4l2_hevc_pps_num_tile_rows() helpers for the tile loops, and bail out of\nassemble_hw_pps() before indexing priv_tbl->param_set[] with an\nout-of-range pic_parameter_set_id, so the writes stay within the hardware\ntables." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The bad values are fields of the V4L2_CID_STATELESS_HEVC_PPS control, which a local process sets with VIDIOC_S_EXT_CTRLS on the rkvdec /dev/videoN node. rkvdec_hevc_run() then passes them to assemble_hw_pps() and compute_tiles_*(). No network protocol delivers these fields to the kernel; a userspace bitstream parser sits in between.\nAC:L - std_validate_compound() never range-checks num_tile_columns_minus1, num_tile_rows_minus1 or pic_parameter_set_id, all u8 values up to 255. The attacker sets TILES_ENABLED with a value above 19, or pic_parameter_set_id of 64 or more, queues a decode request, and the out-of-bounds write happens every time.\nPR:L - rkvdec_open() and the stateless control and request ioctls have no capability checks. The attacker needs only ordinary access to the decoder device node, such as video group membership or a media service context.\nUI:N - The attacker supplies the malicious PPS control and triggers the decode job alone. No other user has to do anything.\nS:U - This is memory corruption inside the kernel, reached from a local process. The impact stays within the kernel's own security authority; no VM or IOMMU boundary is crossed.\nC:H - In rkvdec-vdpu381-hevc.c, assemble_hw_pps() lets compute_tiles_uniform()/compute_tiles_non_uniform() write up to 256 u16 entries into the 20- and 22-entry arrays column_width[] and row_height[] on the kernel stack. The non-uniform path also reads past pps->column_width_minus1[]. Stack corruption like this can be used to leak kernel memory.\nI:H - The loops overwrite the stack past column_width[20]/row_height[22] with values derived from attacker-set PPS and SPS fields. Separately, param_set[pic_parameter_set_id] with an id of 64 or more, and the COLUMN_WIDTH(i)/ROW_HEIGHT(i) WRITE_PPS loop, write outside the intended hardware tables. Both are out-of-bounds kernel writes.\nA:H - Overflowing the column_width/row_height arrays on the stack trips the stack protector or corrupts saved state, which causes a kernel panic or oops. The attacker can trigger it again with every queued decode request." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/media/platform/rockchip/rkvdec/rkvdec-hevc-common.c", "drivers/media/platform/rockchip/rkvdec/rkvdec-hevc.c", "drivers/media/platform/rockchip/rkvdec/rkvdec-vdpu381-hevc.c" ], "versions": [ { "version": "3595375c2301653d5440d54b396df03499686c20", "lessThan": "03beb248d8a7bab30559a60d4df81f167e63b9e3", "status": "affected", "versionType": "git" }, { "version": "3595375c2301653d5440d54b396df03499686c20", "lessThan": "81ad46bb33d8fd279aaa33af5296c648814c964b", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/media/platform/rockchip/rkvdec/rkvdec-hevc-common.c", "drivers/media/platform/rockchip/rkvdec/rkvdec-hevc.c", "drivers/media/platform/rockchip/rkvdec/rkvdec-vdpu381-hevc.c" ], "versions": [ { "version": "6.19", "status": "affected" }, { "version": "0", "lessThan": "6.19", "status": "unaffected", "versionType": "semver" }, { "version": "7.2.7", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.19", "versionEndExcluding": "7.2.7" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.19", "versionEndExcluding": "7.3" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/03beb248d8a7bab30559a60d4df81f167e63b9e3" }, { "url": "https://git.kernel.org/stable/c/81ad46bb33d8fd279aaa33af5296c648814c964b" } ], "title": "media: rkvdec: bound HEVC tile loops and PPS id to the array capacity", "x_generator": { "engine": "bippy-1.2.0" } } } }