CVE-2026-97580

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:LAttack vector, local

The bad values are fields of the V4L2_CID_STATELESS_HEVC_PPS control, which a local process sets with VIDIOC_S_EXT_CTRLS on the rkvdec /dev/videoN node. rkvdec_hevc_run() then passes them to assemble_hw_pps() and compute_tiles_*(). No network protocol delivers these fields to the kernel; a userspace bitstream parser sits in between.

AC:LAttack complexity, low

std_validate_compound() never range-checks num_tile_columns_minus1, num_tile_rows_minus1 or pic_parameter_set_id, all u8 values up to 255. The attacker sets TILES_ENABLED with a value above 19, or pic_parameter_set_id of 64 or more, queues a decode request, and the out-of-bounds write happens every time.

PR:LPrivileges required, low

rkvdec_open() and the stateless control and request ioctls have no capability checks. The attacker needs only ordinary access to the decoder device node, such as video group membership or a media service context.

UI:NUser interaction, none

The attacker supplies the malicious PPS control and triggers the decode job alone. No other user has to do anything.

S:UScope, unchanged

This is memory corruption inside the kernel, reached from a local process. The impact stays within the kernel's own security authority; no VM or IOMMU boundary is crossed.

C:HConfidentiality impact, high

In rkvdec-vdpu381-hevc.c, assemble_hw_pps() lets compute_tiles_uniform()/compute_tiles_non_uniform() write up to 256 u16 entries into the 20- and 22-entry arrays column_width[] and row_height[] on the kernel stack. The non-uniform path also reads past pps->column_width_minus1[]. Stack corruption like this can be used to leak kernel memory.

I:HIntegrity impact, high

The loops overwrite the stack past column_width[20]/row_height[22] with values derived from attacker-set PPS and SPS fields. Separately, param_set[pic_parameter_set_id] with an id of 64 or more, and the COLUMN_WIDTH(i)/ROW_HEIGHT(i) WRITE_PPS loop, write outside the intended hardware tables. Both are out-of-bounds kernel writes.

A:HAvailability impact, high

Overflowing the column_width/row_height arrays on the stack trips the stack protector or corrupts saved state, which causes a kernel panic or oops. The attacker can trigger it again with every queued decode request.