Impact
Based on the description, it is inferred that the media driver for TI VPE contains a flaw in the function vip_probe_slice(). The code checks the result of devm_kzalloc() with PTR_ERR_OR_ZERO(), which incorrectly treats a NULL pointer as zero rather than an error code. This incorrect check could result in the function proceeding with a NULL pointer, potentially leading to a kernel crash or local denial of service.
Affected Systems
The affected component is the TI Video Processing Engine (VPE) driver within the Linux kernel’s media subsystem. No specific kernel versions are listed, so all kernels that include the unpatched VPE driver code are potentially impacted. Since the bug is in the internal driver logic, typical end‑users do not see a user‑level error message.
Risk and Exploitability
The CVSS score is 5.5, EPSS is less than 1%, and the vulnerability is not listed in CISA KEV, indicating a moderate but not high priority threat. The attack vector is inferred to be local, requiring an attacker to load the kernel module or trigger media processing that exercises vip_probe_slice(). If an attacker can force a failed allocation, the kernel may crash, allowing for denial of service but not remote code execution.
OpenCVE Enrichment