CVE-2026-97580
- Source
- https://cve.org/CVERecord?id=CVE-2026-97580
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-97580.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-97580
- Downstream
- Published
- 2026-09-25T10:22:01Z
- Modified
- 2026-09-26T03:48:29Z
- Severity
-
- 7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- media: rkvdec: bound HEVC tile loops and PPS id to the array capacity
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
media: rkvdec: bound HEVC tile loops and PPS id to the array capacity
compute_tiles_uniform() and compute_tiles_non_uniform() loop over num_tile_columns_minus1 + 1 / num_tile_rows_minus1 + 1 entries, and assemble_hw_pps() writes one COLUMN_WIDTH / ROW_HEIGHT register per tile and indexes priv_tbl->param_set[] by pic_parameter_set_id, all taken from the untrusted PPS. Use the bounded v4l2_hevc_pps_num_tile_columns() / v4l2_hevc_pps_num_tile_rows() helpers for the tile loops, and bail out of assemble_hw_pps() before indexing priv_tbl->param_set[] with an out-of-range pic_parameter_set_id, so the writes stay within the hardware tables.
- Database specific
{ "cna_assigner": "Linux", "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/97xxx/CVE-2026-97580.json" }- References
-
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- https://git.kernel.org/stable/c/03beb248d8a7bab30559a60d4df81f167e63b9e3
- https://git.kernel.org/stable/c/81ad46bb33d8fd279aaa33af5296c648814c964b
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/97xxx/CVE-2026-97580.json
- https://nvd.nist.gov/vuln/detail/CVE-2026-97580