{"id":"CVE-2026-97579","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: mediatek: vcodec: bound AV1 tile-start copy to the array capacity\n\nvdec_av1_slice_setup_tile() copies tile_cols + 1 / tile_rows + 1 entries\ninto mi_col_starts[] …","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: mediatek: vcodec: bound AV1 tile-start copy to the array capacity\n\nvdec_av1_slice_setup_tile() copies tile_cols + 1 / tile_rows + 1 entries\ninto mi_col_starts[] …","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","vendor":"Linux","product":"Linux","affected":["Linux >= 0934d37596151edce115c6d0843a9ad7d5e5d232 < ad47a250afafa3a51cfb4a004463ff28e66c596e","Linux >= 0934d37596151edce115c6d0843a9ad7d5e5d232 < 7992059c045780095ba5a696dcb2f5400a82803c","Linux >= 0934d37596151edce115c6d0843a9ad7d5e5d232 < eb0ea3898e3921900939e30c3946dd2b52281859","Linux >= 0934d37596151edce115c6d0843a9ad7d5e5d232 < 37bef2170d4c88fc3d708eecf3ef0f4032bc1372","Linux 6.6"],"published":"2026-09-25","updated":"2026-09-25","sourceUpdated":"2026-09-25T15:18:00.053","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-97579","references":[{"url":"https://git.kernel.org/stable/c/37bef2170d4c88fc3d708eecf3ef0f4032bc1372","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7992059c045780095ba5a696dcb2f5400a82803c","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ad47a250afafa3a51cfb4a004463ff28e66c596e","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/eb0ea3898e3921900939e30c3946dd2b52281859","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"tags":["nvd","cve.org"],"ingestedAt":"2026-09-25T11:06:38.909Z","slug":"CVE-2026-97579","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmedia: mediatek: vcodec: bound AV1 tile-start copy to the array capacity\n\nvdec_av1_slice_setup_tile() copies tile_cols + 1 / tile_rows + 1 entries\ninto mi_col_starts[] / mi_row_starts[] from the bitstream tile_info. Bound\nthe copy to the array capacity.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":210988,"id":"CVE-2026-97579","ts":1790349121605,"field":"cvss","old":null,"new":"7.8"},{"seq":210987,"id":"CVE-2026-97579","ts":1790349121605,"field":"severity","old":"none","new":"high"}]}