CVE-2026-97579 — media: mediatek: vcodec: bound AV1 tile-start copy to the array capacity
In the Linux kernel, the following vulnerability has been resolved: media: mediatek: vcodec: bound AV1 tile-start copy to the array capacity vdec_av1_slice_setup_tile() copies…
Published: 2026-09-25 · CVSS: 7.8 · CVSS 3.1
In the Linux kernel, the following vulnerability has been resolved: media: mediatek: vcodec: bound AV1 tile-start copy to the array capacity vdec_av1_slice_setup_tile() copies tile_cols + 1 / tile_rows + 1 entries into mi_col_starts[] / mi_row_starts[] from the bitstream tile_info. Bound the copy to the array capacity.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7