CVE-2026-52907: media: rockchip: rkcif: fix off by one bugs

Synopsis

An off-by-one memory access vulnerability exists in the Linux kernel's Rockchip RKCIF camera interface driver (media/rockchip/rkcif). A local attacker with a low-privilege account can trigger the flaw without any network access or user interaction. Successful exploitation gives the attacker full read, write, and crash capability over the affected kernel subsystem. A patched-image rebuild at the fix versions is available on HarborGuard for environments running an affected kernel.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network access is required to reach the vulnerable driver.

• AuthenticationRequired

  Any low-privilege local account is sufficient to trigger the off-by-one access; no administrator rights are needed.

• Victim interactionNot required

  No user interaction is needed; the attacker can trigger the bug entirely on their own.

• Attack complexityDetail

  Exploitation is reliable and condition-free; no race condition or special memory layout is required.

Blast Radius

• Reads kernel memory contents, which may expose session tokens, credentials, or other sensitive data held in kernel space.
• Writes to out-of-bounds kernel memory, allowing corruption of kernel data structures or escalation of privileges.
• Crashes the affected kernel subsystem or the entire host, causing a denial of service for all workloads on that node.
• Compromises the integrity of the RKCIF camera capture pipeline, which may corrupt media data processed by the driver.