CVE-2026-97577

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the Verisilicon Rockchip media component where the rockchip vpu981 av1 dec set tile info() function indexes the tile group entry array using tile1 * tile cols + tile0. Because the tile group entry control is a dynamic array sized based on userspace submissions and is independent of tile cols and tile rows, a frame claiming more tiles than available entries can cause an out-of-bounds read. Additionally, frames claiming more than AV1 MAX TILES can result in the hardware being programmed for more tiles than the descriptor buffer can hold.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.