The rkcif driver for Rockchip devices in the Linux kernel omitted a mandatory connection flag for its pads, causing a null pointer dereference when a media stream is enabled on a pad that is not connected. This flaw follows the CWE-166 pattern, resulting in a kernel oops and a system crash that halts media services and can affect overall system stability. Based on the description, the likely attack vector is that an actor enables a media stream on an unconnected pad within the rkcif subsystem, which may require local privileges or exploitation of existing media control interfaces.

This vulnerability is confined to the Linux kernel’s rkcif media subsystem. All installations of the Linux kernel that include the rkcif driver and have not incorporated the recent patch adding the MUST_CONNECT flag check are affected. Devices built on Rockchip SoCs that enable the media framework are the primary targets.

EPSS score of < 1% indicates a very low but non‑zero likelihood of exploitation, though no public exploit has been reported. The kernel null pointer dereference can lead to a crash if an attacker can trigger a media stream on an unconnected pad, resulting in service disruption. The absence of documented exploits suggests it is inferred that the attack would require local privilege to trigger the stream‑enabling path. No public exploitation reports are cited in the available references; this statement is inferred from the absence of exploitation indicators and is not a confirmed finding. The vulnerability is not listed in CISA KEV, but the high impact on system stability warrants prompt mitigation.