The Linux kernel media driver for Verisilicon Rockchip hardware contains a flaw where the function handling AV1 tile information can divide by zero when the tile column count is zero and writes a descriptor per tile into a DMA buffer that can be overrun. This unchecked division and buffer write can corrupt memory, potentially crashing the kernel or, in the worst case, allowing an attacker to trigger an arbitrary kernel code execution if a crafted AV1 bitstream is decoded.

Any system running the Linux kernel with the Verisilicon Rockchip VPU981 AV1 decoder enabled is potentially impacted. The relevant components are the media driver and the function names rockchip_vpu981_av1_dec_set_tile_info. Systems that load this driver for AV1 decoding, such as media playback devices or embedded systems using Rockchip processors, fall under the affected scope.

The CVSS score is 7.8, and the EPSS score is unavailable; the vulnerability is not in the CISA KEV catalog. Therefore, exploitation is not known to be widespread. However, the flaw requires a crafted AV1 stream containing a zero tile column value, implying that a local attacker or one who can supply media to the driver could trigger it. The potential outcome is a kernel crash (Denial of Service) or, depending on memory corruption, a possible privilege escalation to kernel level. The patch in the kernel mitigates the risk by guarding the division and limiting buffer writes.