CVE-2026-52907: Linux Kernel Rockchip Buffer Overflow

CVE-2026-52907 Overview

CVE-2026-52907 is an off-by-one vulnerability in the Linux kernel's Rockchip Camera Interface (rkcif) media driver. The flaw resides in array boundary checks that used > instead of >= comparisons. This allowed code paths to access one element beyond the end of fixed-size arrays. Upstream maintainers resolved the issue by correcting the comparison operators and replacing _MAX enum values with the ARRAY_SIZE macro for safer bounds enforcement. The vulnerability affects systems running affected Linux kernel versions on Rockchip platforms that use the rkcif camera interface driver.

Critical Impact

Out-of-bounds array access in a kernel media driver can lead to memory corruption, information disclosure, or a kernel panic on affected Rockchip-based systems.

Affected Products

• Linux kernel media: rockchip: rkcif driver
• Rockchip System-on-Chip (SoC) platforms using the rkcif camera interface
• Embedded Linux distributions shipping the vulnerable kernel driver

Discovery Timeline

• 2026-06-09 - CVE-2026-52907 published to NVD
• 2026-06-09 - Last updated in NVD database

Technical Details for CVE-2026-52907

Vulnerability Analysis

The vulnerability is an off-by-one error [CWE-193] in the rkcif driver, part of the Linux media subsystem for Rockchip SoCs. The original code used > comparisons against array size boundaries when validating indices. This logic permitted index values equal to the array length, causing reads or writes one element past the valid range. The upstream fix changes the comparisons to >=, ensuring the index must be strictly less than the array size. Maintainers also replaced hardcoded _MAX enum values with ARRAY_SIZE, which derives the bound directly from the array declaration and prevents drift between enum definitions and array sizes.

Root Cause

The root cause is incorrect boundary logic. A check written as if (index > ARRAY_MAX) accepts index == ARRAY_MAX, which is one beyond the last valid index of a zero-based array. The correct check is if (index >= ARRAY_MAX). Reliance on a separate _MAX enum value rather than ARRAY_SIZE increased the chance of mismatch when the array definition changed.

Attack Vector

Exploitation requires reaching the affected code path within the rkcif driver, typically through media device ioctl calls or video capture configuration on systems exposing the Rockchip camera interface. A local actor with access to the media device node could supply crafted parameters that trigger the boundary check failure. The EPSS score for this issue is 0.018% at the 5.19 percentile, indicating exploitation activity is not predicted.

No verified proof-of-concept exploit code is available. The vulnerability mechanism is documented in the upstream kernel commits 73e119036b3a and e4056b84af0f.

Detection Methods for CVE-2026-52907

Indicators of Compromise

• Unexpected kernel oops or panic messages referencing rkcif driver functions in dmesg output.
• Kernel Address Sanitizer (KASAN) reports identifying out-of-bounds access within the Rockchip media driver.
• Abnormal failures or hangs when applications interact with /dev/video* nodes backed by the rkcif driver.

Detection Strategies

• Inventory Rockchip-based devices and identify kernel versions that predate the upstream fix commits.
• Enable KASAN in test or staging kernels to surface out-of-bounds accesses during camera driver exercise.
• Audit kernel build configurations for CONFIG_VIDEO_ROCKCHIP_CIF to determine which systems include the affected driver.

Monitoring Recommendations

• Forward kernel log events to a centralized logging platform and alert on rkcif-related faults or warnings.
• Track package update status for Linux kernel images across embedded fleets to confirm patch propagation.
• Monitor process access patterns to media device nodes from unprivileged users.

How to Mitigate CVE-2026-52907

Immediate Actions Required

• Update to a Linux kernel build that includes the upstream commits 73e119036b3a and e4056b84af0f.
• Restrict access to media device nodes such as /dev/video* to trusted users and processes only.
• For devices that do not require the Rockchip camera interface, disable or unload the rkcif driver module.

Patch Information

The fix is available in the mainline Linux kernel through two commits: Kernel Git Commit 73e1190 and Kernel Git Commit e4056b8. Both replace > with >= in array boundary checks and use ARRAY_SIZE instead of _MAX enum constants. Distribution maintainers should backport these commits to long-term support kernel branches affected by the issue.

Workarounds

• Remove or blacklist the rkcif kernel module on systems that do not need camera capture functionality.
• Apply Linux capability restrictions and udev permissions to limit which accounts can open the media device nodes.
• Run vulnerable workloads in isolated environments until the patched kernel is deployed.