Linux Kernel EUVD-2026-86888

Requires local access to a system with a Rockchip video decoder (rkvdec) exposing the stateless V4L2 HEVC decode interface (/dev/videoN), plus permission to open that device and submit a decode job. The attacker must supply a crafted HEVC Picture Parameter Set with num_tile_columns_minus1/num_tile_rows_minus1 or pic_parameter_set_id values exceeding the driver's array capacity. Limiting factors: exploitation is gated on Rockchip decode hardware being present and accessible (not a default on general servers/desktops), requires local low-privileged access (CVSS PR:L, AV:L), and the realistic outcome is a kernel crash rather than code execution or data disclosure.

This is a high-CVSS-but-low-real-world-priority issue. The NVD CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 7.8) correctly captures the LOCAL attack vector and low-privilege requirement, but the C:H/I:H/A:H impact triple is overstated: the flaw is an out-of-bounds WRITE past fixed hardware register/parameter tables driven by untrusted HEVC PPS fields (num_tile_columns_minus1/num_tile_rows_minus1 and pic_parameter_set_id), which realistically yields a kernel crash/DoS rather than reliable confidentiality loss - a more defensible impact is closer to C:N/I:L/A:H (~5.0). There is no EPSS score, no CISA KEV listing, and no public exploit code, so no signal of active or imminent exploitation. SSVC data is not provided. Exploitation requires local access to a specific Rockchip video-decode device and a crafted bitstream, so this is a targeted, hardware-gated local DoS, not a widespread remote threat. Note conflict: NVD/vendor tag this 'Information Disclosure' while the actual defect per the patch is an OOB write (memory corruption/DoS) - the label is inaccurate.

A local user with access to the Rockchip V4L2 stateless HEVC decoder device (/dev/videoN) submits a crafted HEVC stream whose PPS specifies tile column/row counts or a pic_parameter_set_id exceeding the driver's hardware table capacity, causing assemble_hw_pps() and the compute_tiles_* loops to write out of bounds. This most plausibly corrupts adjacent kernel/HW-table memory and crashes the system (DoS). No public exploit code exists at time of analysis, and the attack requires local access plus specific Rockchip decode hardware.