The Linux kernel’s rkcif media driver contains an off‑by‑one comparison that can cause the driver to read or write past the end of a statically allocated array. The change from ‘>’ to ‘>=’ and the use of ARRAY_SIZE prevents this bounds error. The vulnerability is an example of a CWE‑193 error. Based on the CVE description, it is inferred that attacker‑controlled media data could trigger the off‑by‑one bug.

The flaw exists in any Linux kernel that contains the rkcif media driver without the posted patch. All builds of the kernel that have not incorporated the referenced commit remain vulnerable. Devices running unpatched kernels that use this driver are affected.

The CVSS score of 7.8 indicates a high severity of the off‑by‑one array vulnerability. The EPSS score of <1% shows low reported exploitation probability. The flaw is not listed in the CISA KEV catalog and no public exploits are known. Because the bug occurs while processing media streams, it would require attacker‑controlled media data to trigger the vulnerability. It is unclear whether this could lead to remote code execution or privilege escalation.