Linux Kernel EUVD-2026-32240

Exploitation requires local code execution on a system running a vulnerable Linux kernel with the CONFIG_DRM_EXYNOS driver loaded (effectively Samsung Exynos SoC platforms - embedded boards, Tizen devices, certain Samsung Android/Chromebook variants), and the attacker must possess read/write access to a DRM render/control node such as /dev/dri/card0 (per CVSS PR:L, typically granted via the 'video' or 'render' group or the active graphical seat). The specific trigger is invocation of the VIDI connection ioctl handled by vidi_connection_ioctl(); no user interaction is required (UI:N). Exploitation is limited by the requirement that the target hardware/kernel actually expose the Exynos VIDI virtual display component, by the need for local access to the DRM device, and by the fact that the corrupted pointer's contents depend on whatever unrelated driver populated the master device's driver_data - making reliable memory-corruption exploitation (beyond DoS) dependent on kernel build configuration and runtime state.

The CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates a local, low-complexity, low-privilege issue with high impact across confidentiality, integrity, and availability - consistent with a kernel memory corruption flaw reachable via an ioctl from an unprivileged user with access to the DRM character device. However, real-world risk is materially lower than CVSS alone suggests: EPSS is 0.02% (7th percentile), the issue is not in CISA KEV, no public PoC is known, and the affected driver (Exynos VIDI) is only relevant on Samsung Exynos-based platforms with the DRM Exynos driver compiled in - predominantly embedded/mobile rather than typical server fleets. The supplied tag set includes 'Denial Of Service,' which aligns with the most likely realized impact (NULL deref / crash) rather than reliable code execution; achieving the use-after-free outcome required for privilege escalation depends on the contents of the unrelated driver's driver_data field and would require additional exploit primitives. Note the conflict between the 'Denial Of Service' tag and the CVSS C:H/I:H rating - defenders should treat reliable LPE as plausible but unproven from the data provided.

A local unprivileged user on a Samsung Exynos-based Linux device with the exynos-drm driver loaded opens /dev/dri/card0 and issues the VIDI connection ioctl. The kernel resolves the wrong device's driver_data as a struct vidi_context pointer, and depending on memory layout the attacker triggers either a denial of service (NULL dereference / kernel panic) or, with additional grooming of the colocated driver's data, an out-of-bounds or use-after-free that could be developed into a local privilege escalation primitive.