The Linux media driver for the verisilicon rockchip VPU981 decoder calculates a tile index in a manner that can read beyond the bounds of an internal array when an AV1 frame reports more tiles than the driver has reserved space for. This overread can expose fragments of kernel memory and, in addition, can program the hardware with tile dimensions that exceed the buffer size held by the descriptor, potentially causing a crash. The flaw is an out‑of‑bounds read that may lead to information leakage or a denial‑of‑service of the kernel.

Any Linux kernel build that includes the verisilicon rockchip VPU981 AV1 decoder driver is affected. The issue exists in all kernel versions released before the patch that hardens the tile‑capacity verification. No vendor‑specific version numbers are supplied, but any distribution shipping such a kernel is potentially compromised.

The CVSS score of 7.8 indicates a high severity vulnerability. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector requires a malicious application able to feed AV1 frames to the V4L2 driver, such as a compromised media player or streaming client. The vulnerability does not provide a straightforward remote code execution path but can still compromise kernel integrity through read or crash scenarios.