In the Linux kernel V4L2 Vivid media driver, the functions that update format capabilities (vivid_update_format_cap/out) were called without first verifying that the capture or output queue was idle. If a user sets controls such as CROP, COMPOSE, or SCALE between requesting buffers (REQBUFS) and starting the stream (STREAMON), the driver may alter the format while the queue is busy, corrupting driver state or causing a crash. This instability can abruptly stop media capture or crash applications that depend on the device, resulting in a denial of service.

Any Linux kernel image that ships the unpatched V4L2 Vivid driver is potentially affected. The flaw is present in all kernels lacking the vb2_is_busy() guard and the added WARN_ON. No specific version range is listed, so any kernel containing the vulnerable code path is susceptible. Devices that expose the CROP, COMPOSE, or SCALE controls on a V4L2 Vivid interface may experience failures when those controls are modified while a queue is active.

The CVSS score of 7.8 designates a high severity level, while the EPSS score of < 1% indicates a very low but non‑zero exploitation probability. The vulnerability is not included in the CISA KEV catalog, suggesting that there are no known large‑scale attacks. The attack vector inferred from the description is local: an attacker must have the ability to modify video controls on the device between REQBUFS and STREAMON. Remote exploitation without local device access is not supported by the available information. Consequently, the risk remains significant for systems that rely on persistent or critical media capture.