Linux Kernel EUVD-2026-86886

Requires local access to a device with the Rockchip verisilicon VPU981 AV1 hardware decoder driver loaded and its V4L2 decode device node (/dev/videoN) accessible to the attacker (PR:L). The attacker must supply a crafted AV1 stateless-decode control/bitstream with either tile_cols=0 (to hit the unguarded division) or a tile_cols/tile_rows count exceeding AV1_MAX_TILES (to overrun the tile_info DMA buffer). LIMITING FACTORS: not remotely reachable (AV:L), confined to Rockchip RK3588-class SoCs with this specific decoder - the vast majority of Linux systems do not run this driver - and no user interaction beyond the attacker's own decode request.

This is a classic high-CVSS-but-low-real-risk kernel driver flaw. The NVD vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (7.8 HIGH) is overstated for what the patch actually fixes: rockchip_vpu981_av1_dec_set_tile_info() (1) divides context_update_tile_id by a bitstream-supplied tile_cols that can be zero (divide-by-zero crash) and (2) writes one descriptor per tile into a fixed AV1_MAX_TILES-sized DMA buffer using bitstream tile_cols/rows, allowing an out-of-bounds write past the tile_info buffer. The realistic outcome is an out-of-bounds write / crash (DoS), not the full confidentiality and integrity compromise the C:H/I:H implies - so I assess closer to ~5.0. Crucially, exploitation is gated: it requires local access to a physical Rockchip VPU981 (RK3588-class) hardware video decoder exposed via a V4L2 /dev/videoN node, plus the ability to feed a crafted AV1 stateless-decode control. There is no EPSS score, no CISA KEV listing, and no public POC; SSVC data is absent. Signals are consistent in pointing to a low-priority, hardware-niche, local-only crash bug rather than a widely exploitable issue. Note the input Tags label this 'Information Disclosure,' which conflicts with the actual OOB-write/DoS nature described.

A local user on a Rockchip RK3588-class device with the verisilicon VPU981 AV1 decoder driver loaded opens the V4L2 decoder device and submits a crafted AV1 bitstream/control declaring tile_cols=0 (triggering a divisor crash) or an excessive tile_cols/tile_rows count (overrunning the AV1_MAX_TILES tile_info DMA buffer). The result is a kernel out-of-bounds write or divide-by-zero, causing memory corruption or a crash. No public exploit code is identified at time of analysis.