Out-of-bounds read in Linux kernel - CVE-2026-97577

Vulnerability details

The vulnerability allows a local user to perform out-of-bounds memory reads and writes.

The vulnerability exists due to improper bounds checking in rockchip_vpu981_av1_dec_prepare_run() and rockchip_vpu981_av1_dec_set_tile_info() when processing AV1 frames whose claimed tile count exceeds the submitted tile group entry count or the tile descriptor buffer capacity. A local user can submit a crafted AV1 frame with excessive tile dimensions to perform out-of-bounds memory reads and writes.

Affected software

How to mitigate CVE-2026-97577

External References

• https://git.kernel.org/stable/c/367db8b23c26a913d76ed70457bbcd781c422b49
• https://git.kernel.org/stable/c/40029f7f35397853f8711d6fce1d90a4c7a01f8c
• https://git.kernel.org/stable/c/a41babf528f70c9a82ed31cfb5fe19065910f7f0
• https://git.kernel.org/stable/c/fd965369220cc160bb20a24991790814bfbab401

Related Security Bulletins

• Out-of-bounds read in Linux kernel platform verisilicon driver