HIGH Introduced in 6.19
rkvdec PpsTable OOB
CVE-2026-97580
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI7.8HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: media: rkvdec: bound HEVC tile loops and PPS id to the array capacity compute_tiles_uniform() and compute_tiles_non_uniform() loop over num_tile_columns_minus1 + 1 / num_tile_rows_minus1 + 1 entries, and assemble_hw_pps() writes one COLUMN_WIDTH / ROW_HEIGHT register per tile and indexes priv_tbl->param_set[] by pic_parameter_set_id, all taken from the untrusted PPS. Use the bounded v4l2_hevc_pps_num_tile_columns() / v4l2_hevc_pps_num_tile_rows() helpers for the tile loops, and bail out of assemble_hw_pps() before indexing priv_tbl->param_set[] with an out-of-range pic_parameter_set_id, so the writes stay within the hardware tables.
02KernelScan AI Analysis
Risk summary
A local process with access to a Rockchip rkvdec V4L2 video decoder device can submit a crafted HEVC stream whose Picture Parameter Set contains oversized tile counts or an out-of-range parameter-set id. These untrusted values are used as loop bounds and array indices without validation, causing out-of-bounds writes into kernel heap memory. Successful exploitation can corrupt kernel data structures, leading to denial of service or potential privilege escalation.
Vulnerability analysis
The Rockchip video decoder driver for HEVC streams uses untrusted size values from the submitted video data as loop counters and as an index into an internal kernel table that stores hardware decoding parameters. A crafted stream can provide oversized tile counts and an out-of-range table index, causing the driver to write past the end of the hardware parameter storage and corrupt adjacent kernel heap memory. The corrected driver now enforces the validated maximums on the tile loops and checks that the table index is within bounds before performing the write. Any local process that can open the video decoder device and submit a HEVC bitstream can reach this flaw.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 7.2 | 6.19 | 7.2.7 | 03beb248d8a7 |
| mainline | 6.19 | 7.3-rc3 | 81ad46bb33d8 |