{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-97580","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2026-09-24T16:01:01.156Z","datePublished":"2026-09-25T10:22:01.832Z","dateUpdated":"2026-09-25T14:41:23.543Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-09-25T14:41:23.543Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: rkvdec: bound HEVC tile loops and PPS id to the array capacity\n\ncompute_tiles_uniform() and compute_tiles_non_uniform() loop over\nnum_tile_columns_minus1 + 1 / num_tile_rows_minus1 + 1 entries, and\nassemble_hw_pps() writes one COLUMN_WIDTH / ROW_HEIGHT register per tile\nand indexes priv_tbl->param_set[] by pic_parameter_set_id, all taken from\nthe untrusted PPS. Use the bounded v4l2_hevc_pps_num_tile_columns() /\nv4l2_hevc_pps_num_tile_rows() helpers for the tile loops, and bail out of\nassemble_hw_pps() before indexing priv_tbl->param_set[] with an\nout-of-range pic_parameter_set_id, so the writes stay within the hardware\ntables."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The bad values are fields of the V4L2_CID_STATELESS_HEVC_PPS control, which a local process sets with VIDIOC_S_EXT_CTRLS on the rkvdec /dev/videoN node. rkvdec_hevc_run() then passes them to assemble_hw_pps() and compute_tiles_*(). No network protocol delivers these fields to the kernel; a userspace bitstream parser sits in between.\nAC:L - std_validate_compound() never range-checks num_tile_columns_minus1, num_tile_rows_minus1 or pic_parameter_set_id, all u8 values up to 255. The attacker sets TILES_ENABLED with a value above 19, or pic_parameter_set_id of 64 or more, queues a decode request, and the out-of-bounds write happens every time.\nPR:L - rkvdec_open() and the stateless control and request ioctls have no capability checks. The attacker needs only ordinary access to the decoder device node, such as video group membership or a media service context.\nUI:N - The attacker supplies the malicious PPS control and triggers the decode job alone. No other user has to do anything.\nS:U - This is memory corruption inside the kernel, reached from a local process. The impact stays within the kernel's own security authority; no VM or IOMMU boundary is crossed.\nC:H - In rkvdec-vdpu381-hevc.c, assemble_hw_pps() lets compute_tiles_uniform()/compute_tiles_non_uniform() write up to 256 u16 entries into the 20- and 22-entry arrays column_width[] and row_height[] on the kernel stack. The non-uniform path also reads past pps->column_width_minus1[]. Stack corruption like this can be used to leak kernel memory.\nI:H - The loops overwrite the stack past column_width[20]/row_height[22] with values derived from attacker-set PPS and SPS fields. Separately, param_set[pic_parameter_set_id] with an id of 64 or more, and the COLUMN_WIDTH(i)/ROW_HEIGHT(i) WRITE_PPS loop, write outside the intended hardware tables. Both are out-of-bounds kernel writes.\nA:H - Overflowing the column_width/row_height arrays on the stack trips the stack protector or corrupts saved state, which causes a kernel panic or oops. The attacker can trigger it again with every queued decode request."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/media/platform/rockchip/rkvdec/rkvdec-hevc-common.c","drivers/media/platform/rockchip/rkvdec/rkvdec-hevc.c","drivers/media/platform/rockchip/rkvdec/rkvdec-vdpu381-hevc.c"],"versions":[{"version":"3595375c2301653d5440d54b396df03499686c20","lessThan":"03beb248d8a7bab30559a60d4df81f167e63b9e3","status":"affected","versionType":"git"},{"version":"3595375c2301653d5440d54b396df03499686c20","lessThan":"81ad46bb33d8fd279aaa33af5296c648814c964b","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/media/platform/rockchip/rkvdec/rkvdec-hevc-common.c","drivers/media/platform/rockchip/rkvdec/rkvdec-hevc.c","drivers/media/platform/rockchip/rkvdec/rkvdec-vdpu381-hevc.c"],"versions":[{"version":"6.19","status":"affected"},{"version":"0","lessThan":"6.19","status":"unaffected","versionType":"semver"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","status":"unaffected","versionType":"semver"},{"version":"7.3-rc3","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.19","versionEndExcluding":"7.2.7"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.19","versionEndExcluding":"7.3-rc3"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/03beb248d8a7bab30559a60d4df81f167e63b9e3"},{"url":"https://git.kernel.org/stable/c/81ad46bb33d8fd279aaa33af5296c648814c964b"}],"title":"media: rkvdec: bound HEVC tile loops and PPS id to the array capacity","x_generator":{"engine":"bippy-1.2.0"}}}}