In the Linux kernel media driver, the vivid_update_format_cap/out() functions were called without checking whether the capture or output queue was busy. For controls that enable CROP, COMPOSE, or SCALE capabilities, this was not performed. If a user sets these controls between a buffer request (REQBUFS) and start of streaming (STREAMON), the functions may alter the format while the queue is active, leading to unexpected results such as driver crashes or inconsistent media capture. The vulnerability could thus allow a local or remote user with access to the device to trigger a denial‑of‑service or corrupt media data.

All Linux kernel images that include the V4L2 Vivid media driver before the patch. No specific kernel version range is listed in the data, so any kernel that ships the unpatched code is potentially vulnerable.

The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting that it has not been widely observed in the wild. However, syzkaller reports indicate a possible race or corruption scenario, implying that an attacker could exploit interleaved control changes to induce a crash. The CVSS score is not provided, but given the potential for a DoS via media device misuse, the risk is moderate to high for affected systems.