CVE-2026-97580
Description
In the Linux kernel, the following vulnerability has been resolved: media: rkvdec: bound HEVC tile loops and PPS id to the array capacity compute_tiles_uniform() and compute_tiles_non_uniform() loop over num_tile_columns_minus1 + 1 / num_tile_rows_minus1 + 1 entries, and assemble_hw_pps() writes one COLUMN_WIDTH / ROW_HEIGHT register per tile and indexes priv_tbl->param_set[] by pic_parameter_set_id, all taken from the untrusted PPS. Use the bounded v4l2_hevc_pps_num_tile_columns() / v4l2_hevc_pps_num_tile_rows() helpers for the tile loops, and bail out of assemble_hw_pps() before indexing priv_tbl->param_set[] with an out-of-range pic_parameter_set_id, so the writes stay within the hardware tables.
How to fix
- Linux Linux03beb248d8a7bab30559a60d4df81f167e63b9e3, 81ad46bb33d8fd279aaa33af5296c648814c964b or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | 3595375c2301653d5440d54b396df03499686c20 ≤ v < 03beb248d8a7bab30559a60d4df81f167e63b9e3, 3595375c2301653d5440d54b396df03499686c20 ≤ v < 81ad46bb33d8fd279aaa33af5296c648814c964b, 6.19 | 03beb248d8a7bab30559a60d4df81f167e63b9e3, 81ad46bb33d8fd279aaa33af5296c648814c964b |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.