CVE-2026-97578 media: verisilicon: rockchip: guard VPU981 AV1 divisor and tile buffer
A missing guard in the Rockchip VPU981 AV1 decoder allows division by zero or buffer overflow via crafted bitstreams, causing a kernel crash.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-97578?
CVE-2026-97578 is a high-severity vulnerability in Linux, published on 25 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
media: verisilicon: rockchip: guard VPU981 AV1 divisor and tile buffer
rockchip_vpu981_av1_dec_set_tile_info() divides context_update_tile_id by tile_info->tile_cols and writes one descriptor per tile into the tile_info DMA buffer, which holds AV1_MAX_TILES entries; tile_cols and tile_rows come from the bitstream. Guard the division against a zero tile_cols by initialising the context-update values to zero and computing them only when tile_cols is non-zero, and stop the descriptor writes once the tile_info buffer is full. The tile geometry written to the hardware registers is left unmodified; the per-dimension and total tile bounds are enforced by the control validation.
Which versions are affected by CVE-2026-97578?
How do I fix CVE-2026-97578?
Apply the vendor's patch.
Is CVE-2026-97578 being exploited?
There is no known exploitation of CVE-2026-97578 in the wild and no public exploit code.
Sources
Also known as AZL-104541, BELL-CVE-2026-97578, DEBIAN-CVE-2026-97578, GHSA-cr7v-wxrv-gp29, UBUNTU-CVE-2026-97578.