CVE-2026-97580: media: rkvdec: bound HEVC tile loops and PPS id to the array capacity
In the Linux kernel, the following vulnerability has been resolved:
media: rkvdec: bound HEVC tile loops and PPS id to the array capacity
computetilesuniform() and computetilesnonuniform() loop over numtilecolumnsminus1 + 1 / numtilerowsminus1 + 1 entries, and assemblehwpps() writes one COLUMNWIDTH / ROWHEIGHT register per tile and indexes privtbl->paramset[] by picparametersetid, all taken from the untrusted PPS. Use the bounded v4l2hevcppsnumtilecolumns() / v4l2hevcppsnumtilerows() helpers for the tile loops, and bail out of assemblehwpps() before indexing privtbl->paramset[] with an out-of-range picparametersetid, so the writes stay within the hardware tables.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems using the Linux kernel rkvdec media driver to process HEVC content are exposed when that content supplies an untrusted PPS. The affected parsing paths use PPS-controlled tile counts and picture parameter set IDs.
What does an attacker need to exploit it?
An attacker needs to provide HEVC data containing a PPS with oversized tile-column or tile-row values, or an out-of-range pic_parameter_set_id. These values can cause loops and hardware-table accesses beyond their intended array capacities.
What changes in the resolved code prevent exploitation?
The fix uses bounded helpers for HEVC PPS tile-column and tile-row counts. It also stops PPS assembly before indexing the parameter-set array when pic_parameter_set_id is out of range.