SB20260928359 - Out-of-bounds read in Linux kernel platform verisilicon driver

Description

This security bulletin contains information about 1 vulnerability.

1) Out-of-bounds read (CVE-ID: CVE-2026-97577)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform out-of-bounds memory reads and writes.

The vulnerability exists due to improper bounds checking in rockchip_vpu981_av1_dec_prepare_run() and rockchip_vpu981_av1_dec_set_tile_info() when processing AV1 frames whose claimed tile count exceeds the submitted tile group entry count or the tile descriptor buffer capacity. A local user can submit a crafted AV1 frame with excessive tile dimensions to perform out-of-bounds memory reads and writes.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/367db8b23c26a913d76ed70457bbcd781c422b49
• https://git.kernel.org/stable/c/40029f7f35397853f8711d6fce1d90a4c7a01f8c
• https://git.kernel.org/stable/c/a41babf528f70c9a82ed31cfb5fe19065910f7f0
• https://git.kernel.org/stable/c/fd965369220cc160bb20a24991790814bfbab401