Description

In the Linux kernel, the following vulnerability has been resolved: media: rkvdec: bound HEVC tile loops and PPS id to the array capacity compute_tiles_uniform() and compute_tiles_non_uniform() loop over num_tile_columns_minus1 + 1 / num_tile_rows_minus1 + 1 entries, and assemble_hw_pps() writes one COLUMN_WIDTH / ROW_HEIGHT register per tile and indexes priv_tbl->param_set[] by pic_parameter_set_id, all taken from the untrusted PPS. Use the bounded v4l2_hevc_pps_num_tile_columns() / v4l2_hevc_pps_num_tile_rows() helpers for the tile loops, and bail out of assemble_hw_pps() before indexing priv_tbl->param_set[] with an out-of-range pic_parameter_set_id, so the writes stay within the hardware tables.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-09-25T11:17:08.790Z",
  "pubdate": "2026-09-25T11:17:08.790Z",
  "executiveSummary": "The vulnerability is an out-of-bounds memory access issue located within the rkvdec (Rockchip Video Decoder) driver in the Linux kernel.\nThis flaw specifically affects the HEVC decoding path, where untrusted parameters derived from the Picture Parameter Set (PPS) are used to index internal arrays and control hardware register writes without proper validation.\nThe primary risk involves unauthorized memory writes or potential kernel-level data corruption if a malicious or malformed video bitstream is processed by the decoder.\nAttackers can leverage this vulnerability by supplying a crafted bitstream containing manipulated tile dimensions or invalid pic_parameter_set_id values.\nSuccessful exploitation requires the victim system to have the rkvdec driver enabled and for the attacker to provide a malicious input file to a hardware-accelerated video decoding application.\nThis represents a critical failure in input sanitization, potentially allowing an attacker to breach kernel memory boundaries.",
  "technicalDetails": "The vulnerability originates from insufficient validation of HEVC parameters within the rkvdec driver, specifically inside the functions compute_tiles_uniform(), compute_tiles_non_uniform(), and assemble_hw_pps().\nIn the original implementation, the driver iterates over tile columns and rows based on num_tile_columns_minus1 and num_tile_rows_minus1 provided directly from the untrusted PPS bitstream. Because these values were not bounded, they could exceed the capacity of the driver's internal arrays, leading to out-of-bounds writes to hardware registers when assemble_hw_pps() attempts to configure COLUMN_WIDTH or ROW_HEIGHT.\nFurthermore, the pic_parameter_set_id value from the PPS was used to index the priv_tbl->param_set[] table without verification. If an attacker provides a PPS containing an out-of-range identifier, the driver performs an index operation beyond the allocation bounds of the priv_tbl structure.\nAttack Flow: 1. Attacker delivers a malformed HEVC bitstream to the userspace application that interacts with the V4L2 rkvdec interface. 2. The driver parses the PPS headers, extracting the attacker-controlled tile counts and pic_parameter_set_id. 3. During execution of compute_tiles_uniform() or compute_tiles_non_uniform(), the lack of bounds checking causes the loop to process or write beyond the designated memory region. 4. In assemble_hw_pps(), the unvalidated pic_parameter_set_id is used as an array index, resulting in an arbitrary write or read offset within kernel memory.\nThe exploitation leads to memory corruption, which may result in a system panic (DoS) or, theoretically, the redirection of kernel execution flow if internal structures are overwritten with attacker-controlled data.\nThe remediation involves replacing the unsafe direct usage of PPS fields with the v4l2_hevc_pps_num_tile_columns() and v4l2_hevc_pps_num_tile_rows() helper functions, which enforce strict architectural bounds. Additionally, explicit conditional checks were introduced to validate the pic_parameter_set_id against the array capacity before any indexing occurs, ensuring that operations are strictly contained within pre-allocated kernel memory."
}