{"id":"CVE-2026-97579","published":"2026-09-25T11:17:08.677","lastModified":"2026-09-25T15:18:00.053","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: mediatek: vcodec: bound AV1 tile-start copy to the array capacity\n\nvdec_av1_slice_setup_tile() copies tile_cols + 1 / tile_rows + 1 entries\ninto mi_col_starts[] / mi_row_starts[] from the bitstream tile_info. Bound\nthe copy to the array capacity.","cvssScore":7.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":[],"vendors":[],"products":[],"references":[{"url":"https://git.kernel.org/stable/c/37bef2170d4c88fc3d708eecf3ef0f4032bc1372","tags":[]},{"url":"https://git.kernel.org/stable/c/7992059c045780095ba5a696dcb2f5400a82803c","tags":[]},{"url":"https://git.kernel.org/stable/c/ad47a250afafa3a51cfb4a004463ff28e66c596e","tags":[]},{"url":"https://git.kernel.org/stable/c/eb0ea3898e3921900939e30c3946dd2b52281859","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}