CVE-2026-97580 Linux CVE debrief

Who should care

Linux kernel maintainers, Linux distribution vendors, and users of Linux-based systems should assess and apply patches for CVE-2026-97580. These stakeholders need to verify bounding of HEVC tile loops and PPS id to array capacity and review compensating controls for exposed systems while remediation is scheduled and verified.

Why it matters

CVE-2026-97580 is a Linux kernel vulnerability affecting the media: rkvdec component. The vulnerability has been resolved by bounding HEVC tile loops and PPS id to the array capacity. Linux kernel maintainers, Linux distribution vendors, and users of Linux-based systems should assess and apply patches.

• Verify bounding of HEVC tile loops and PPS id to array capacity
• Assess Linux kernel versions for potential exposure
• Apply patches for Linux kernel vulnerability CVE-2026-97580

Technical summary

The Linux kernel vulnerability CVE-2026-97580 is related to the media: rkvdec component. The vulnerability has been resolved by bounding HEVC tile loops and PPS id to the array capacity. This issue was addressed by using the bounded v4l2_hevc_pps_num_tile_columns() and v4l2_hevc_pps_num_tile_rows() helpers for the tile loops, and bailing out of assemble_hw_pps() before indexing priv_tbl->param_set[] with an out-of-range pic_parameter_set_id. The vulnerability affects Linux kernel versions and has been addressed by the Linux kernel maintainers.

Defensive priority

Assess and apply patches for Linux kernel vulnerability CVE-2026-97580

Recommended defensive actions

• Assess Linux kernel versions for potential exposure
• Apply patches for Linux kernel vulnerability CVE-2026-97580
• Verify bounding of HEVC tile loops and PPS id to array capacity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the Linux kernel vulnerability. However, additional information on affected versions and exploitation is limited. The vulnerability has been resolved by bounding HEVC tile loops and PPS id to the array capacity. The official CVE Program record and NVD detail page offer source-provided CVE metadata and vulnerability assessment.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.