The vulnerability resides in the Rockchip RGA subsystem of the Linux kernel. A function that prepares buffers for image processing, rga_buf_init(), does not verify the return value of rga_get_frame(), which can return a special error pointer when an unsupported or invalid buffer type is requested. Accessing the size field through an invalid pointer will trigger a kernel fault and cause the system to crash. The failure results in a denial of service because the kernel degrades to an unsafe state and may require a reboot.

All Linux kernel releases that include the Rockchip RGA driver are potentially affected. No specific kernel versions are listed in the advisory, but the issue can arise in any build that contains the unpatched rga_buf_init() function.

The exploit requires local access to the affected kernel driver. A malicious user must be able to invoke the RGA interface with an invalid or unsupported buffer type to trigger the invalid dereference. While no CVSS or EPSS scores are published, the lack of an easily exploitable code execution path suggests a moderate risk primarily limited to system instability. The vulnerability is not listed in the CISA KEV catalog, indicating that no widespread exploitation has been reported.