This issue stems from CWE-166: Incorrect Initialization, where the Linux kernel iris driver fails to initialize essential platform data fields for the SM8750 device, preventing allocation of vital internal buffers and causing basic decode and encode operations to fail at session start. Without the max_core_mbps capability entry, the driver’s capability checks are incomplete, leading to non‑compliant V4L2 encoder behavior. These deficiencies translate to a loss of media functionality and can interrupt workflows that rely on SM8750 hardware.

The issue exists in kernel builds that contain the iris driver without the recent commit that supplies the missing get_vpu_buffer_size and max_core_mbps entries. Systems running any Linux distribution with the affected kernel and the SM8750 hardware are affected; specifically, any environment that loads the iris driver for media operations.

The vulnerability carries an inherent risk of local denial of service when media sessions are initiated, as the driver fails to start and media pipelines break. The likely attack vector is a local user or process that can trigger media operations on the system, exploiting the missing buffer allocation and incomplete capability checks. The EPSS score is less than 1%, indicating a very low exploitation likelihood but still nonzero. The CVSS score of 5.5 indicates moderate severity. The issue is not listed in the CISA KEV catalog, suggesting limited known exploitation. Nevertheless, the lack of buffer allocation and capability checks creates a security weakness that could be leveraged by an attacker with the ability to trigger media operations on the system.