HIGH Introduced in 6.6
vcodec AV1Tile OOB
CVE-2026-97579
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI7.4HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: media: mediatek: vcodec: bound AV1 tile-start copy to the array capacity vdec_av1_slice_setup_tile() copies tile_cols + 1 / tile_rows + 1 entries into mi_col_starts[] / mi_row_starts[] from the bitstream tile_info. Bound the copy to the array capacity.
02KernelScan AI Analysis
Risk summary
A local user with access to the MediaTek V4L2 hardware video decoder can trigger an out-of-bounds write in kernel heap memory by submitting a crafted AV1 bitstream with tile column or row counts exceeding the decoder's internal array capacity. This can corrupt adjacent kernel memory, leading to information disclosure, privilege escalation, or kernel crashes. The issue affects systems using the MediaTek Vcodec AV1 stateless decoder driver.
Vulnerability analysis
The MediaTek AV1 video decoder copies data from an incoming bitstream into fixed-size internal arrays without checking whether the stream declares more tile columns or rows than those arrays can hold. A crafted video stream can therefore write past the end of the arrays and corrupt adjacent kernel memory. The fix limits the copy so it cannot exceed the arrays' capacity. The decoder is reached through the local V4L2 device interface, so any user with permission to submit video for hardware decoding can trigger the flaw; on many embedded and Android systems this includes unprivileged applications, while on typical servers access is restricted to the video group.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.12 | 6.6 | 6.12.111 | ad47a250afaf |
| 6.18 | 6.6 | 6.18.53 | 7992059c0457 |
| 6.6 | 6.6 | 6.6.158 | f19acf00818a |
| 7.2 | 6.6 | 7.2.7 | eb0ea3898e39 |
| mainline | 6.6 | 7.3 | 37bef2170d4c |
| cip/6.12 | 6.6 | 6.12.111-cip32 | ad47a250afaf |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/6.12 | Fixed in 6.12.111-cip32 |