UBUNTU-CVE-2026-97577: High severity ubuntu/linux-hwe-edge vulnerability

In the Linux kernel, the following vulnerability has been resolved: media: verisilicon: rockchip: reject AV1 frames exceeding the tile capacity rockchipvpu981av1decsettileinfo() indexes the tile group entry array by tile1 tilecols + tile0, reading up to tilecols tilerows entries, lays out one descriptor per tile in the AV1MAXTILES tileinfo buffer, and programs the real tilecols / tilerows into the hardware. The tile group entry control is a dynamic array sized to the number of entries userspace submitted, independent of tilecols / tilerows, so a frame that claims more tiles than entries reads past the array. A frame that claims more than AV1MAXTILES tiles also leaves the hardware programmed for more tiles than the descriptor buffer holds. Reject both in preparerun(): tilecols tilerows must not exceed the submitted entry count or AV1MAXTILES. The entry count is read via v4l2ctrlfind() (ctrl->elems). This mirrors the bound the mediatek AV1 decoder already enforces.