{"id":29009,"date":"2026-09-25T20:31:41","date_gmt":"2026-09-25T12:31:41","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-97577"},"modified":"2026-09-25T20:31:41","modified_gmt":"2026-09-25T12:31:41","slug":"cve-2026-97577","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-97577","title":{"rendered":"CVE-2026-97577 &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: verisilicon: r"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>media: verisilicon: rockchip: reject AV1 frames exceeding the tile capacity<\/p>\n<p>rockchip_vpu981_av1_dec_set_tile_info() indexes the tile group entry<br \/>\narray by tile1 * tile_cols + tile0, reading up to tile_cols * tile_rows<br \/>\nentries, lays out one descriptor per tile in the AV1_MAX_TILES tile_info<br \/>\nbuffer, and programs the real tile_cols \/ tile_rows into the hardware.<\/p>\n<p>The tile group entry control is a dynamic array sized to the number of<br \/>\nentries userspace submitted, independent of tile_cols \/ tile_rows, so a<br \/>\nframe that claims more tiles than entries reads past the array. A frame<br \/>\nthat claims more than AV1_MAX_TILES tiles also leaves the hardware<br \/>\nprogrammed for more tiles than the descriptor buffer holds.<\/p>\n<p>Reject both in prepare_run(): tile_cols * tile_rows must not exceed the<br \/>\nsubmitted entry count or AV1_MAX_TILES. The entry count is read via<br \/>\nv4l2_ctrl_find() (ctrl-&gt;elems). This mirrors the bound the mediatek AV1<br \/>\ndecoder already enforces.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>media: verisilicon: rockchip: reject AV1 frames exceeding the tile capacity<\/p>\n<p>rockchip_vpu981_av1_dec_set_tile_info() indexes the ti<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-29009","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/29009","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=29009"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=29009"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=29009"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}