CVE-2026-97578: media: verisilicon: rockchip: guard VPU981 AV1 divisor and tile buffer
In the Linux kernel, the following vulnerability has been resolved:
media: verisilicon: rockchip: guard VPU981 AV1 divisor and tile buffer
rockchipvpu981av1decsettileinfo() divides contextupdatetileid by tileinfo->tilecols and writes one descriptor per tile into the tileinfo DMA buffer, which holds AV1MAXTILES entries; tilecols and tilerows come from the bitstream. Guard the division against a zero tilecols by initialising the context-update values to zero and computing them only when tilecols is non-zero, and stop the descriptor writes once the tileinfo buffer is full. The tile geometry written to the hardware registers is left unmodified; the per-dimension and total tile bounds are enforced by the control validation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.158.1-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.158 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.111 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.53 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.2.7
Event History
Frequently Asked Questions
What input is required to trigger the issue?
An attacker would need to supply an AV1 bitstream with tile geometry that causes tile_cols to be zero or causes descriptor generation to exceed the fixed AV1_MAX_TILES tile-info DMA buffer.
Which systems are exposed?
Exposure is limited to Linux kernel systems using the Rockchip VPU981 AV1 decoder path that processes attacker-controlled or otherwise untrusted AV1 bitstreams.
Are the hardware tile-geometry registers also protected by this change?
The change does not modify the tile geometry written to hardware registers. The description states that per-dimension and total tile bounds for that geometry are enforced by control validation.
How can I determine whether my kernel includes the fix?
Check whether the kernel source includes the referenced stable commits or equivalent changes that avoid computing context-update values when tile_cols is zero and stop tile-info descriptor writes when the DMA buffer is full.