The Linux kernel’s V4L2 control infrastructure for HEVC slice parameters lacks a verification step that ensures the active Level‑0 and Level‑1 reference counts fall within expected bounds before the driver consumes them. Because this common validation path is bypassed, a user‑space application can inject out‑of‑range reference indices—including sentinel values such as 0xff—into the kernel. The kernel forwards these values to the device driver without further checking, leaving the driver to interpret them as valid. This oversight can cause drivers to misbehave or fail, potentially resulting in incorrect decoding logic or a loss of correct operation. The CVE entry does not provide evidence of a guaranteed memory corruption or code execution and therefore does not explicitly state higher‑impact outcomes.

All Linux kernel builds that expose the V4L2 HEVC slice controls are affected. The vendor list indicates Linux:Linux, meaning every kernel with this component prior to the patch. No vendor‑specific version range is provided, so all releases up to the fix are impacted.

The CVSS base score of 7.8 indicates a high severity. The EPSS score of less than 1% suggests a low likelihood of exploitation. The flaw is not listed in CISA KEV. Because user‑space can construct malformed V4L2 control packets, the likelihood of exploitation is limited to local attackers with the ability to access the relevant device. A local attacker could potentially trigger driver misbehavior or a denial of service, but the description does not indicate a broader privilege escalation or remote exploitation.