In the Linux kernel, the amlogic‑c3 media driver contains a buffering flaw that occurs when the number of zones specified in an auto‑exposure or auto‑white‑balance configuration exceeds the size of the zone weight array. This out‑of‑bounds write can corrupt kernel memory; the update to the driver adds checks that prevent the overflow. The vulnerability is a classic buffer overflow (CWE‑787) and was identified by scan analysis of the source files c3‑isp‑params.c.

Any Linux system that implements the amlogic‑c3 driver, typically those running a kernel version that includes the media driver for Amlogic C3 SoCs. No specific vendor or sub‑version is listed, so any kernel that contains this driver is potentially affected.

Based on the description, it is inferred that an attacker would need to manipulate the AE/AWB configuration data via the media subsystem. The likely attack vector is local or privileged user control of the media driver, allowing an out‑of‑bounds write to corrupt kernel memory. The CVSS score of 7.3 indicates medium severity. The EPSS score of < 1% shows low exploitation probability, and the vulnerability is not in the CISA KEV catalog. While the exploitation path is not detailed, kernel memory corruption could lead to severe consequences if leveraged.