In the Linux kernel’s Qualcomm media subsystem, the vfe_isr() function loops over seven image master indices but writes to a line array that is only sized for four entries. When the index reaches 4, 5, or 6, the code accesses beyond vfe->line[]’s bounds, causing an out‑of‑bounds memory access. Based on the description, this corruption could allow a local attacker to read or modify arbitrary kernel memory, potentially leading to privilege escalation or complete system compromise. The vulnerability is a classic case of array bounds violation, which is classified as kernel memory corruption (CWE‑805) and array subscript out‑of‑bounds (CWE‑125).

The flaw resides in the Linux kernel media driver that implements the Qualcomm Camera SubSystem (vfe) for camera hardware. Although the vendor list is generic (Linux:Linux), any Linux kernel that contains the affected driver code and does not include the recent commit to correct the bounds is impacted. No specific kernel version range is provided, so any deployment of an older kernel with the legacy vfe_isr_reg_update logic is vulnerable.

The CVSS score of 7.8 indicates a high severity, but the EPSS score of < 1% suggests a very low likelihood of exploitation at this time. The vulnerability is not yet listed in the CISA KEV catalog, further indicating limited active exploitation. The attack vector is likely local, inferred from the need for an attacker to activate the camera subsystem to trigger the faulty loop. Because no publicly known exploit exists and the exploit probability is low, the overall risk is moderate pending the deployment of the patch.