media: verisilicon: rockchip: guard VPU981 AV1 divisor and tile buffer (CVE-2026-97578) | HOL Guard CVE

High · CVSS 7.8CVE-2026-97578

media: verisilicon: rockchip: guard VPU981 AV1 divisor and tile buffer

Answer in brief

CVE-2026-97578 records a High severity (CVSS 7.8) vulnerability in media: verisilicon: rockchip: guard VPU981 AV1 divisor and tile buffer. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.

Analysis pending evidence review

HOL Guard separates source facts from reviewed analysis. See the methodology.

Published Sep 25, 2026Updated Sep 25, 2026Source checked Sep 25, 2026First seen by HOL Sep 25, 2026Material review Sep 25, 2026

Upstream Advisory

Key facts

Risk: High · CVSS 7.8
Exploitation: Not marked as known exploited
Affected software: 2 mapped packages or products
Fix availability: Available

Why this deserves its current priority

CVSS is 7.8. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Analysis status

Analysis pending evidence review

Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.

Affected scope and exposure questions

The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.

Mapped affected packages and fixed versions
Package	Affected range	Fixed version
Linux/Linuxgeneric	>=727a400686a2c0d25015c9e44916a59b72882f83 <7baa7bb1b784c19170df8c99466fa412040eb431 \|\| >=727a400686a2c0d25015c9e44916a59b72882f83 <8f19d869a9f6800547c9ad7ebaf3b94f973dab50 \|\| >=727a400686a2c0d25015c9e44916a59b72882f83 <6b7a281a815ae7c5e7bb2aad039ffea9bc933157 \|\| >=727a400686a2c0d25015c9e44916a59b72882f83 <b84f6533a8ed2fd7b282fc7ab4b8efadc745a89c	7baa7bb1b784c19170df8c99466fa412040eb431, 8f19d869a9f6800547c9ad7ebaf3b94f973dab50, 6b7a281a815ae7c5e7bb2aad039ffea9bc933157, b84f6533a8ed2fd7b282fc7ab4b8efadc745a89c
Linux/Linuxgeneric	6.5	Not reported

Recommended response

Check inventory. Check lockfiles and deployed manifests for Linux/Linux, Linux/Linux.
Review the reported fix. Update Linux/Linux to 7baa7bb1b784c19170df8c99466fa412040eb431 if you use the affected versions. Test the change in a non-production environment first.

Evidence timeline and material changes

Published upstream
Sep 25, 2026
Evidence: source:cvelist:source_dates:source-dates:record
Source modified
Sep 25, 2026
Evidence: source:cvelist:source_dates:source-dates:record
First seen by HOL
Sep 25, 2026

Sources and claim methodology

Upstream source description

In the Linux kernel, the following vulnerability has been resolved: media: verisilicon: rockchip: guard VPU981 AV1 divisor and tile buffer rockchip_vpu981_av1_dec_set_tile_info() divides context_update_tile_id by tile_info->tile_cols and writes one descriptor per tile into the tile_info DMA buffer, which holds AV1_MAX_TILES entries; tile_cols and tile_rows come from the bitstream. Guard the division against a zero tile_cols by initialising the context-update values to zero and computing them only when tile_cols is non-zero, and stop the descriptor writes once the tile_info buffer is full. The tile geometry written to the hardware registers is left unmodified; the per-dimension and total tile bounds are enforced by the control validation.

Quoted source text, attributed separately from HOL analysis.