← Back to the live CVE advisory feed

CVE-2026-97578: Product identification pending

Severity

7.8 (HIGH)

Patch status

Unknown

Published

2026-09-25T11:17:08.567

Modified

2026-09-25T15:17:59.930

Why it matters

This matters because the affected product may allow code execution. Prioritize systems that are internet-facing or have privileged access to other infrastructure.

Recommended admin actions

• Review and patch based on exposure, asset criticality, and business impact.
• Review logs for suspicious activity related to the affected application or component.

Technical summary

In the Linux kernel, the following vulnerability has been resolved: media: verisilicon: rockchip: guard VPU981 AV1 divisor and tile buffer rockchip_vpu981_av1_dec_set_tile_info() divides context_update_tile_id by tile_info->tile_cols and writes one descriptor per tile into the tile_info DMA buffer, which holds AV1_MAX_TILES entries; tile_cols and tile_rows come from the bitstream. Guard the division against a zero tile_cols by initialising the context-update values to zero and computing them only when tile_cols is non-zero, and stop the descriptor writes once the tile_info buffer is full. The tile geometry written to the hardware registers is left unmodified; the per-dimension and total tile bounds are enforced by the control validation.

View the official NVD record for CVE-2026-97578

CVE data is sourced from NVD/CNA records and optional enrichment. Validate against the vendor advisory before taking production action.