{"id":"CVE-2026-97580","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: rkvdec: bound HEVC tile loops and PPS id to the array capacity\n\ncompute_tiles_uniform() and compute_tiles_non_uniform() loop over\nnum_tile_columns_minus1 + 1 / n…","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: rkvdec: bound HEVC tile loops and PPS id to the array capacity\n\ncompute_tiles_uniform() and compute_tiles_non_uniform() loop over\nnum_tile_columns_minus1 + 1 / n…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","vendor":"Linux","product":"Linux","affected":["Linux >= 3595375c2301653d5440d54b396df03499686c20 < 03beb248d8a7bab30559a60d4df81f167e63b9e3","Linux >= 3595375c2301653d5440d54b396df03499686c20 < 81ad46bb33d8fd279aaa33af5296c648814c964b","Linux 6.19"],"published":"2026-09-25","updated":"2026-09-25","sourceUpdated":"2026-09-25T15:18:00.170","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-97580","references":[{"url":"https://git.kernel.org/stable/c/03beb248d8a7bab30559a60d4df81f167e63b9e3","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/81ad46bb33d8fd279aaa33af5296c648814c964b","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"tags":["nvd","cve.org"],"ingestedAt":"2026-09-25T11:06:38.909Z","slug":"CVE-2026-97580","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmedia: rkvdec: bound HEVC tile loops and PPS id to the array capacity\n\ncompute_tiles_uniform() and compute_tiles_non_uniform() loop over\nnum_tile_columns_minus1 + 1 / num_tile_rows_minus1 + 1 entries, and\nassemble_hw_pps() writes one COLUMN_WIDTH / ROW_HEIGHT register per tile\nand indexes priv_tbl->param_set[] by pic_parameter_set_id, all taken from\nthe untrusted PPS. Use the bounded v4l2_hevc_pps_num_tile_columns() /\nv4l2_hevc_pps_num_tile_rows() helpers for the tile loops, and bail out of\nassemble_hw_pps() before indexing priv_tbl->param_set[] with an\nout-of-range pic_parameter_set_id, so the writes stay within the hardware\ntables.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":210980,"id":"CVE-2026-97580","ts":1790349120886,"field":"cvss","old":null,"new":"7.8"},{"seq":210979,"id":"CVE-2026-97580","ts":1790349120886,"field":"severity","old":"none","new":"high"}]}