In the Linux kernel media subsystem, the rkvdec driver processes HEVC streams that come from an untrusted source. Based on the description, the attack vector is feeding a malicious HEVC bitstream to the driver. The tile calculation functions read the number of tile columns and rows directly from the input PPS, and the assembly routine writes a hardware register for each tile while indexing an internal parameter table by the picture parameter set ID. Because these values are not bounded, a malicious stream can supply in‑range tile counts that exceed the table size or an out‑of‑range picture parameter set ID, causing the code to write beyond the allocated array. This kernel out‑of‑bounds write can corrupt memory or driver state, leading to a kernel crash or potentially enabling a privilege‑escalation exploit if the attacker can trigger the overflow within the kernel context.

Any Linux system that deploys the media/rkvdec driver for Rockchip VDEC hardware, regardless of distribution, is subject to this flaw as long as the kernel includes the vulnerable compute_tiles_uniform(), compute_tiles_non_uniform(), and assemble_hw_pps() implementations. No explicit kernel version numbers are listed; users should ensure they are running a kernel that contains the recent fix that bounds tile loops and checks the picture parameter set index.

Based on the description, the exploited code path requires feeding a crafted HEVC stream to the decoder. The CVSS base score of 7.8 indicates a high‑severity kernel memory corruption flaw. Attackers could succeed locally or remotely if media inputs are accepted through a network service or exposed interfaces. The EPSS score is not available, and the flaw is not catalogued in CISA KEV, but the potential for a kernel crash or privilege escalation means the risk remains significant. When exploited, the impact could be a denial of service or an elevation of privilege to root. Prompt patching is recommended.