vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2026-97579

media: mediatek: vcodec: bound AV1 tile-start copy to the array capacity

HIGH
7.8
CVSS Score
Published: September 25, 2026 at 10:22 AM UTC
Updated: October 19, 2026 at 10:17 AM UTC
1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
HIGH7.8
Exploit prediction
EPSS 0.2%

Description

In the Linux kernel, the following vulnerability has been resolved: media: mediatek: vcodec: bound AV1 tile-start copy to the array capacity vdec_av1_slice_setup_tile() copies tile_cols + 1 / tile_rows + 1 entries into mi_col_starts[] / mi_row_starts[] from the bitstream tile_info. Bound the copy to the array capacity.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Linux Kernel· Linux
90%
0934d37596151edce115c6d0843a9ad7d5e5d2326.6934d37596151edce115c6d843a9ad7d5e5d232
Vendor states this is fixed in 37bef2170d4c88fc3d708eecf3ef0f4032bc1372 (fixed)
Vendor states this is fixed in 7992059c045780095ba5a696dcb2f5400a82803c (fixed)
Vendor states this is fixed in ad47a250afafa3a51cfb4a004463ff28e66c596e (fixed)
Vendor states this is fixed in eb0ea3898e3921900939e30c3946dd2b52281859 (fixed)
Vendor states this is fixed in f19acf00818a9eada06a77715d0188c181fb435e (fixed)
Vendor states this is fixed in 6.12.111 (unaffected)
Vendor states this is fixed in 6.18.53 (unaffected)
Vendor states this is fixed in 6.6 (unaffected)
Vendor states this is fixed in 6.6.158 (unaffected)
Vendor states this is fixed in 7.2.7 (unaffected)
Vendor states this is fixed in 7.3 (unaffected)
Vendor states this is fixed in 7.3-rc3 (unaffected)

Remediation

No guide yet

No remediation guidance has been written for this CVE yet, and no fixed version or vendor advisory is recorded against it.

References (5)

Source: cverecord
https://git.kernel.org/stable/c/ad47a250afafa3a51cfb4a004463ff28e66c596e
Source: cverecord
https://git.kernel.org/stable/c/7992059c045780095ba5a696dcb2f5400a82803c
Source: cverecord
https://git.kernel.org/stable/c/eb0ea3898e3921900939e30c3946dd2b52281859
Source: cverecord
https://git.kernel.org/stable/c/37bef2170d4c88fc3d708eecf3ef0f4032bc1372
Source: cverecord
https://git.kernel.org/stable/c/f19acf00818a9eada06a77715d0188c181fb435e

CVSS

7.8HIGHLinux
Vector?

Quick Info

StatusRECEIVED

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card