The vulnerability in the Linux kernel’s Cedrus driver arises when the driver accepts H.264 reference list entries from stateless slice control that reference indices outside the fixed V4L2_H264_NUM_DPB_ENTRIES array. The driver then attempts to look up these indices in the decode->dpb[] array, leading to an out-of-bounds read of kernel memory. This can expose sensitive kernel data to a local attacker and potentially be leveraged for privilege escalation or further exploitation.

All Linux kernel installations that include the Cedrus media driver and have not yet incorporated the commit that guards against invalid reference indices. The specific kernel versions affected are not listed, but any kernel that implements the pre-fix Cedrus path is vulnerable until the patch is applied.

Without a patched kernel, the CVSS score for this issue is not disclosed, and EPSS is unavailable, but the existence of an out-of-bounds read indicates a non-trivial local code execution risk if an attacker can feed a crafted H.264 stream to the driver. The vulnerability is not currently listed in the CISA KEV catalog. The most likely attack vector is local: an attacker with access to a video device that uses the Cedrus driver can provide a malformed H.264 stream to trigger the read. The effect is information disclosure and potentially kernel privilege escalation if combined with additional local exploits.