Linux Kernel EUVD-2026-28580

Requires local authenticated access to an i.MX8MQ platform-based Linux system running vulnerable kernel versions (5.14 through pre-6.19.6 or pre-7.0). Attacker must have permissions to open and submit decode jobs to video device nodes (/dev/video*), typically granted to users in the 'video' group or processes with CAP_SYS_ADMIN. Exploitation requires simultaneously initiating H.264 and HEVC decode operations to trigger G1/G2 VPU contention. Limits to exploitation: hardware-specific to i.MX8MQ SoC only (not reproducible on other platforms), requires local access (not remotely exploitable per AV:L), and depends on video subsystem being actively used. Default configurations on embedded systems often restrict video device access to dedicated media processes, reducing attack surface.

This represents a low-probability local denial-of-service risk despite the CVSS base score of 5.5. CVSS vector AV:L/AC:L/PR:L indicates exploitation requires local authenticated access with straightforward exploitation steps, limiting attack surface to compromised local accounts or malicious applications. The EPSS score of 0.02% (5th percentile) suggests extremely low observed exploitation in the wild, consistent with the hardware-specific nature of the flaw (only i.MX8MQ platform affected). No CISA KEV listing and no public POC code further support low real-world urgency. However, impact severity is notable: high availability impact (S:U/C:N/I:N/A:H) means affected systems can experience complete VPU subsystem failure and potential kernel hangs requiring reboot. Primary risk applies to embedded devices using i.MX8MQ for video processing workloads (set-top boxes, automotive infotainment, industrial vision systems) where untrusted local applications could intentionally trigger the condition. Desktop/server Linux systems are unaffected due to different hardware platforms. Priority should be moderate for affected embedded deployments, low for general Linux infrastructure.

A local authenticated attacker with access to video device nodes (/dev/video*) crafts two concurrent video decode processes, one initiating H.264 decoding on the G1 VPU and another simultaneously starting HEVC decoding on the G2 VPU. The hardware bus contention triggers immediate VPU subsystem errors, causing decode timeouts and corrupted frame output. Repeated exploitation causes resource exhaustion and potential kernel deadlock requiring system reboot, denying video processing services to legitimate applications.