The vulnerability resides in the Rockchip RGA subsystem of the Linux kernel. A function that prepares buffers for image processing, rga_buf_init(), does not verify the return value of rga_get_frame(), which can return a special error pointer when an unsupported or invalid buffer type is requested. Accessing the size field through an invalid pointer will trigger a kernel fault and cause the system to crash. The failure results in a denial of service because the kernel degrades to an unsafe state and may require a reboot.

All Linux kernel releases that include the Rockchip RGA driver are potentially affected. No specific kernel versions are listed in the advisory, but the issue can arise in any build that contains the unpatched rga_buf_init() function.

The exploit requires local access to the affected kernel driver. A malicious user must be able to invoke the RGA interface with an invalid or unsupported buffer type to trigger the invalid dereference. The CVSS score of 5.5 indicates moderate severity, and the EPSS < 1% suggests that exploitation is unlikely. The vulnerability is not listed in the CISA KEV catalog, indicating no widespread exploitation has been reported.