Description

In the Linux kernel, the following vulnerability has been resolved: media: mediatek: vcodec: bound AV1 tile-start copy to the array capacity vdec_av1_slice_setup_tile() copies tile_cols + 1 / tile_rows + 1 entries into mi_col_starts[] / mi_row_starts[] from the bitstream tile_info. Bound the copy to the array capacity.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-09-25T11:17:08.677Z",
  "pubdate": "2026-09-25T11:17:08.677Z",
  "executiveSummary": "A buffer overflow vulnerability exists in the MediaTek video codec driver within the Linux kernel, specifically within the AV1 slice decoding logic. The vulnerability arises from an improper boundary check when copying tile start coordinates from the bitstream into internal storage arrays.\nThe flaw is classified as an out-of-bounds write vulnerability. If an attacker provides a crafted video bitstream containing malicious tile information, they can trigger a write operation that exceeds the pre-allocated capacity of the mi_col_starts[] or mi_row_starts[] buffers.\nThis vulnerability impacts MediaTek video codec hardware drivers. Successful exploitation could lead to memory corruption, potentially resulting in a system crash (Denial of Service) or arbitrary code execution within the kernel context. The attack requires the ability to supply or influence a video bitstream processed by the vulnerable MediaTek vcodec driver. Exploitation occurs during the slice setup phase, where the driver fails to validate the tile count against array dimensions before memory copy operations.",
  "technicalDetails": "The vulnerability resides in the function vdec_av1_slice_setup_tile() within the MediaTek vcodec driver. The function is responsible for parsing AV1 tile information from a bitstream and populating internal structures, specifically the mi_col_starts[] and mi_row_starts[] arrays, which track tile start positions.\nThe root cause is a lack of bounds checking on the copy operation relative to the fixed size of these arrays. The function calculates the number of entries to copy based on tile_cols + 1 and tile_rows + 1 values derived directly from the bitstream. However, it fails to verify if these calculated values exceed the physical capacity of the destination buffers.\nIn the context of the AV1 codec specification, tile information is provided within the frame header or tile list. A malicious actor can craft a bitstream where the tile_cols or tile_rows values are manipulated to be larger than the hardcoded array limits. When vdec_av1_slice_setup_tile() processes this malformed input, it performs a memory copy (typically using memcpy or direct assignment loops) that writes data past the end of the destination array.\nThe attack flow proceeds as follows: 1) The attacker delivers a malicious AV1 video stream to a system utilizing the MediaTek vcodec driver. 2) The driver initiates the decoding process for the provided slices. 3) The vdec_av1_slice_setup_tile() function is invoked to prepare tile data. 4) The driver reads the tile_cols/tile_rows parameters from the bitstream. 5) Without verifying these against the buffer capacity, the driver attempts to store the tile start data in the arrays. 6) The buffer overflow occurs, overwriting adjacent memory locations on the kernel heap or stack.\nBecause this operation occurs in kernel space, the memory corruption can lead to the overwriting of critical kernel structures, function pointers, or data buffers. This state compromises kernel integrity, facilitating privilege escalation or total system instability. The vulnerability is restricted to the specific media processing logic and does not require pre-existing authentication, provided the attacker can reach the codec hardware interface with the malicious bitstream."
}