HEVC slice parameters are shared stateless V4L2 controls, yet the common validation path did not check the active L0/L1 reference counts before driver code consumed them. This oversight allowed an attacker to provide out‑of‑range reference indices that would be interpreted by the driver, leading to kernel memory corruption and potentially enabling a local privilege escalation.

All Linux kernel builds that expose the v4l2‑ctrls HEVC slice controls are affected. No vendor‑specific version range is listed, so the flaw applies to every kernel prior to the patch that hardens this validation.

The CVSS and EPSS scores are unavailable, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector is local: an attacker with local privileges can construct malformed V4L2 control packets and queue them to a device driver that implements the HEVC slice interface. The driver then consumes the invalid reference counts, which can trigger a crash or a write into kernel memory, providing an avenue for privilege elevation.