Description

In the Linux kernel, the following vulnerability has been resolved: media: verisilicon: rockchip: guard VPU981 AV1 divisor and tile buffer rockchip_vpu981_av1_dec_set_tile_info() divides context_update_tile_id by tile_info->tile_cols and writes one descriptor per tile into the tile_info DMA buffer, which holds AV1_MAX_TILES entries; tile_cols and tile_rows come from the bitstream. Guard the division against a zero tile_cols by initialising the context-update values to zero and computing them only when tile_cols is non-zero, and stop the descriptor writes once the tile_info buffer is full. The tile geometry written to the hardware registers is left unmodified; the per-dimension and total tile bounds are enforced by the control validation.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-09-25T11:17:08.567Z",
  "pubdate": "2026-09-25T11:17:08.567Z",
  "executiveSummary": "A critical vulnerability exists within the Verisilicon VPU981 driver for the Rockchip platform in the Linux kernel, specifically within the AV1 decoding tile information handling. The flaw originates from an unsafe arithmetic operation during the processing of bitstream-derived tile dimensions. An attacker capable of providing a maliciously crafted AV1 bitstream can trigger a division-by-zero error, leading to a kernel-level denial-of-service (DoS) via system panic.\nFurthermore, the vulnerability involves an out-of-bounds memory write condition where the driver attempts to populate a DMA buffer beyond its allocated capacity. By failing to validate the number of tiles against the AV1_MAX_TILES limit, the driver allows for memory corruption within the kernel space. This vulnerability impacts system stability and potentially allows for arbitrary code execution or privilege escalation if the memory corruption can be predictably weaponized. Exploitation requires the attacker to control the input bitstream processed by the VPU, making it a high-risk vector for systems handling untrusted media content.",
  "technicalDetails": "The vulnerability is localized within the rockchip_vpu981_av1_dec_set_tile_info() function in the VPU981 media driver. The function is responsible for parsing AV1 tile information from the bitstream and preparing descriptor data for the hardware VPU. The root cause of the division-by-zero flaw is the direct use of the 'tile_cols' parameter, derived directly from the untrusted bitstream, as a divisor without prior validation. If the bitstream specifies a tile_cols value of zero, the CPU encounters an arithmetic exception, resulting in an immediate kernel panic.\nConcurrent to the division vulnerability, there is a buffer overflow condition. The driver maintains a fixed-size DMA buffer designed to hold a maximum of AV1_MAX_TILES descriptors. The logic iteratively writes tile descriptors based on values extracted from the bitstream. However, the original implementation lacked a bounds check against the AV1_MAX_TILES constant during the descriptor write phase. An attacker can manipulate the tile_cols and tile_rows metadata in the bitstream to force the loop to iterate more times than the destination buffer can accommodate.\nThe attack flow proceeds as follows: 1) The attacker delivers a malformed AV1 video stream to a system utilizing the Rockchip VPU981 hardware. 2) The driver parses the bitstream and extracts the tile configuration. 3) If the attacker sets 'tile_cols' to zero, the system crashes during the division operation. 4) If the attacker provides a large number of tiles, the function performs a sequential write operation into the DMA buffer. Because the bounds check is absent, the write pointer advances past the allocated memory boundary, overwriting adjacent kernel memory structures. This memory corruption can be utilized to overwrite function pointers, kernel objects, or sensitive control structures.\nThe vulnerability is particularly dangerous because the bitstream parsing occurs in the kernel context. While control validation exists for per-dimension and total tile bounds, the specific logic within 'rockchip_vpu981_av1_dec_set_tile_info' failed to enforce these constraints on the DMA buffer writes. Successful exploitation requires no authentication or special privileges if the attacker can feed the malicious bitstream to a decoder process, such as a media player or browser relying on the V4L2 interface to interact with the VPU driver. The post-exploitation impact ranges from local service disruption to potential kernel-level code execution by corrupting the kernel stack or heap."
}