Look up another CVE · open CVE-2026-97579 in the interactive tracker
CVE-2026-97579
media: mediatek: vcodec: bound AV1 tile-start copy to the array capacity
Published 2026-09-25 (24 days ago) by the Linux kernel CNA. Subsystem drivers/media. Debian urgency: unimportant.
What to do, per Debian release
Debian's own status for CVE-2026-97579 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | not affected | 6.1.190-1 | Nothing to do. bookworm never shipped the vulnerable code. |
| Debian 13trixie | fixedDSA-6528-1 · 2026-09-29 · text | 6.12.111-1 | Update the kernel and reboot. DSA-6528-1 shipped the fix on 2026-09-29, in 6.12.111-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.2.7-1 | Update the kernel and reboot. Fixed in 7.2.7-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.2.7-1 | Update the kernel and reboot. Fixed in 7.2.7-1. A running kernel keeps the old code until the machine restarts. |
| Debian 12bookworm · linux-6.12 | fixedDLA-4817-1 · 2026-10-04 · text | 6.12.111-1~deb12u1 | Update the kernel and reboot. DLA-4817-1 shipped the fix on 2026-10-04, in 6.12.111-1~deb12u1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
vdec_av1_slice_setup_tile() copies tile_cols + 1 / tile_rows + 1 entries into mi_col_starts[] / mi_row_starts[] from the bitstream tile_info. Bound the copy to the array capacity.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
drivers/media/platform/mediatek/vcodec/decoder/vdec/vdec_av1_req_lat_if.c
- What this is
- MEDIATEK MEDIA DRIVERMAINTAINERS section matched on drivers/media/platform/mediatek/vcodec/ · Supported
Show whether Debian builds this, per release
Not established. This site could not find the build rule for the affected file in the kernel trees Debian ships, so it has no answer about whether Debian compiles this code. Read that as unknown, never as absent.
- bookworm, trixie, forky, sid, bookworm · linux-6.12?
- ?
- not established - no Makefile entry for the affected file
Where a release above reads "not established", no build rule for the affected file was found in that release's kernel tree. That is a gap in this lookup, not a finding that the code is absent.
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS
Signals
- Published
- 2026-09-25 (24 days ago)source
- CVSS
- 7.8 high
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- local (AV:L)source
- EPSS
- 0.16%, higher than 5.2% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- unimportantsource
- Subsystem
- drivers/media
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 6.6 | 6.6.158 | f19acf00818a |
| 6.6 | 6.12.111 | ad47a250afaf |
| 6.6 | 6.18.53 | 7992059c0457 |
| 6.6 | 7.2.7 | eb0ea3898e39 |
| 6.6 | 7.3 | 37bef2170d4c |
Debian advisories
| Advisory | Date | Shipped to | Debian |
|---|---|---|---|
| DLA-4817-1 | 2026-10-04 | bookworm 6.12.111-1~deb12u1 | tracker |
| DSA-6528-1 | 2026-09-29 | trixie 6.12.111-1 | tracker |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:LAttack vector, local
- The bad tile_info.tile_cols/tile_rows reach vdec_av1_slice_setup_tile() from a local process that sets V4L2_CID_STATELESS_AV1_FRAME via VIDIOC_S_EXT_CTRLS on the mtk-vcodec decoder /dev/videoN and queues a request. A spec-conforming AV1 parser caps tile counts at 64, so a remote bitstream does not produce the malformed values.
- AC:LAttack complexity, low
- The attacker sets tile_cols or tile_rows to any value from 65 to 255. validate_av1_frame() never checks them, and the driver's num_tiles check in vdec_av1_slice_setup_tile_group() runs after vdec_av1_slice_setup_pfc() has already done the copy, so the overflow happens on every such request.
- PR:LPrivileges required, low
- It needs only the ability to open the decoder video node, which is normally granted to the video group or to media/GPU processes. No capability check lies on the ioctl or request-queue path to vdec_av1_slice_lat_decode().
- UI:NUser interaction, none
- The attacker supplies the control payload and queues the request themselves. No other user has to do anything.
- S:UScope, unchanged
- This is a heap overflow in kernel memory. It gives kernel-level impact within the same security authority, not a VM or IOMMU boundary crossing.
- C:HConfidentiality impact, high
- Writing up to 764 bytes past mi_row_starts[] runs off the end of the kzalloc'd vdec_av1_slice_pfc into the neighbouring slab object. That corruption can be used to build read primitives and leak kernel memory.
- I:HIntegrity impact, high
- The written values are ALIGN(ctrl_tile->mi_*_starts[i]) >> mib_size_log2, taken from the attacker's own control payload. This gives an attacker-shaped heap out-of-bounds write that can corrupt neighbouring objects.
- A:HAvailability impact, high
- Corrupting the pfc fields past the tile arrays (frame, state, ref_idx) and the neighbouring slab object can oops the kernel or hang the decoder, and any local user with device access can repeat it.