Skip to main content

Linux Kernel CVE-2026-52907

| EUVDEUVD-2026-35416 HIGH
Off-by-one Error (CWE-193)
2026-06-09 Linux GHSA-wc6w-h9jv-4f9w
Information Disclosure Linux
7.8
CVSS 3.1 · Vendor: Linux
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Obtain local shell on Rockchip device
  2. Delivery
    Open rkcif V4L2 device node
  3. Exploit
    Issue crafted ioctl hitting off-by-one path
  4. Execution
    Corrupt adjacent kernel memory
  5. Impact
    Escalate to root or leak kernel data

Vulnerability Assessment

Weakness
CWE
CWE-193
ASVS 5.0
V15 - Secure Coding and Architecture Off-by-one prevention
Exploitation Conditions

Requires local execution on a Linux system where the Rockchip rkcif (Camera Interface) driver is built and loaded - in practice, an ARM device using a Rockchip SoC with the media subsystem enabled - plus the ability to open the corresponding /dev/video* node, which on most distributions requires membership in the 'video' group or equivalent DAC permissions. No user interaction or network access is involved (AV:L/UI:N). x86_64 servers, cloud VMs, and any system that does not load the rockchip-cif module are not exploitable regardless of kernel version.
Impact

The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H scores 7.8 (High) and assumes local code execution from an unprivileged user can drive the kernel into the buggy path, yielding full C/I/A impact via kernel memory corruption. However, EPSS sits at 0.02% (5th percentile) and the CVE is not on CISA KEV, indicating no observed exploitation; this is a real but low-priority issue for most fleets. Practical reachability is narrow: the vulnerable code is only compiled and loaded on systems using Rockchip SoCs with the rkcif media driver (embedded boards, single-board computers, some Chromebooks/IoT cameras), so general-purpose x86 servers and most cloud workloads are not exposed at all. The signals are internally consistent - high local impact but low real-world exploitation likelihood given the niche driver surface, lack of public POC, and the typical need for V4L2 device access (often gated by the 'video' group), which further raises the practical privilege bar above the PR:L the vector advertises.
Exploit ScenarioDerived

A local user with access to the rkcif V4L2 device node on a Rockchip-based system (e.g., an SBC, kiosk, or embedded camera appliance) issues a crafted ioctl or stream-configuration sequence that drives an index check past the array bound, causing the kernel to dereference adjacent memory. With careful heap grooming this off-by-one read/write could be shaped into kernel information disclosure or privilege escalation to root, though no public exploit code is currently known for this specific bug.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jun 14, 2026

Out-of-bounds array access in the Linux kernel's Rockchip RKCIF camera interface driver (drivers/media/platform/rockchip/rkcif) allows a local low-privileged user to trigger memory corruption by reading one element past the end of internal arrays due to off-by-one comparison errors. Affects mainline Linux through 6.19 and is fixed in 7.0.4 and 7.1-rc1; no public exploit identified at time of analysis and EPSS exploitation probability is negligible (0.02%, 5th percentile).

RemediationAI

Vendor-released patch: upgrade to Linux 7.0.4, 7.1-rc1, or any later mainline/stable release containing the rkcif off-by-one fixes (commits e4056b84af0fc18c84b4e5741df04ecd8ca17973 and 73e119036b3a799170ed89907b4273c07306d611 at https://git.kernel.org/stable/c/e4056b84af0fc18c84b4e5741df04ecd8ca17973 and https://git.kernel.org/stable/c/73e119036b3a799170ed89907b4273c07306d611). Distribution kernels should pick up backports through standard stable updates; verify with uname -r and the distro's CVE tracker. If you cannot patch immediately on affected Rockchip-based devices, restrict access to /dev/video* nodes by tightening the 'video' group membership and udev rules so only trusted services can open the rkcif device (trade-off: legitimate camera/V4L2 userspace such as gstreamer pipelines on that user will break), or blacklist the rockchip-cif module via /etc/modprobe.d if the camera capture path is unused (trade-off: any onboard camera or ISP pipeline relying on it will stop functioning).

Affected VersionsENISA

Linux 6.19
Linux patch: 0
Linux 1f2353f5a1af995efbf7bea44341aa0d03460b28 <e4056b84af0fc18c84b4e5741df04ecd8ca17973
Linux patch: 7.0.4
Linux patch: 7.1-rc1
Linux 1f2353f5a1af995efbf7bea44341aa0d03460b28 <73e119036b3a799170ed89907b4273c07306d611

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The Rockchip RKCIF driver provides V4L2 support for the Camera Interface IP block found on Rockchip SoCs (e.g., RK3399, RK3568, RK3588) used heavily in embedded and SBC devices. The defect is a classic off-by-one bounds check (CWE-193 class) where the code used a strictly-greater-than comparison instead of greater-than-or-equal against array length, permitting an index equal to the array size to be used as a valid offset. The upstream resolution both flips the comparison operator and replaces hard-coded _MAX enum sentinels with ARRAY_SIZE() to keep the bound tied to the actual storage, eliminating the drift risk. CPE coverage (cpe:2.3:a:linux:linux) is broad and version-unbounded, reflecting that the buggy code shipped in mainline media subsystem builds.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Linux) PRIMARY 7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI 5.8 MEDIUM

Local access to a niche Rockchip V4L2 device node (AV:L, PR:L); reliable memory-corruption exploitation needs heap grooming (AC:H); kernel crash is likely (A:H) but C/I impact is unproven (L).

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H
4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N
SUSE 5.3 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
CVSS changed
Jun 14, 2026 - 06:22 NVD
7.8 (HIGH)
Patch available
Jun 09, 2026 - 15:01 EUVD
CVE Published
Jun 09, 2026 - 12:36 nvd
UNKNOWN (no severity yet)
CVE Published
Jun 09, 2026 - 12:36 cve.org
HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

media: rockchip: rkcif: fix off by one bugs

Change these comparisons from > vs >= to avoid accessing one element beyond the end of the arrays. While at it, use ARRAY_SIZE instead of the _MAX enum values.

[fix cosmetic issues]

Executive ViewAI

Why It Matters

A memory corruption vulnerability in the Linux kernel's Rockchip RKCIF camera interface driver (CVE-2026-52907, CVSS 7.8) affects systems running kernel versions through 6.19. No public exploit identified at time of analysis; the vulnerability requires local low-privileged user access, and a vendor patch is available, making this a manageable risk for organizations with standard patch deployment capabilities.

Business Impact: Medium
Compensating Controls

Apply vendor patch: Linux kernel 7.0.4, 7.1-rc1, or later versions. If immediate patching is not feasible, disable the Rockchip RKCIF camera driver on systems where camera functionality is not required, and restrict local system access to trusted users only.

Threat Intelligence Overview

EPSS Score
0.0%
Top 95% exploitable
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Defer
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact
Medium

Priority Score

39
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +39
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Related Vulnerabilities in Linux Kernel Memory and Network Vulnerabilities

View all 20
CVE-2026-46316 CRITICAL
9.3
CVE-2026-46327 HIGH
7.8
CVE-2026-46330 HIGH
7.8
CVE-2026-46325 CRITICAL
9.8
CVE-2026-46323 HIGH
7.8
CVE-2026-46320 HIGH
7.4
CVE-2026-46322 HIGH
7.1
CVE-2026-46332 HIGH
8.0
CVE-2026-46321 HIGH
7.1
CVE-2026-46328 HIGH
7.3
CVE-2026-46317 HIGH
8.8
CVE-2026-46318 MEDIUM
5.5
CVE-2026-46319 HIGH
7.8
CVE-2026-46324 HIGH
7.8
CVE-2026-46326 HIGH
8.4
CVE-2026-46329 MEDIUM
5.5
CVE-2026-52904 MEDIUM
5.5
CVE-2026-52905 MEDIUM
5.5
CVE-2026-52906 HIGH
7.7

Same weakness CWE-193 – Off-by-one Error

View all
CVE-2021-3156 HIGH POC
7.8
CVE-2022-34970 CRITICAL POC
9.8
CVE-2021-31875 CRITICAL POC
9.8
CVE-2020-8443 CRITICAL POC
9.8
CVE-2019-14532 CRITICAL POC
9.8
CVE-2019-19906 HIGH POC
7.5
CVE-2026-86297 HIGH POC
8.2
CVE-2019-13306 HIGH POC
7.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-52907 ADVISORY https://ubuntu.com/security/notices/USN-8488-1 ADVISORY https://ubuntu.com/security/notices/USN-8489-1 ADVISORY https://vuldb.com/vuln/369546 REF https://git.kernel.org/stable/c/73e119036b3a799170ed89907b4273c07306d611 REF https://git.kernel.org/stable/c/e4056b84af0fc18c84b4e5741df04ecd8ca17973

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy