CVE-2026-43297

What it actually does

This is a local denial-of-service flaw in the Linux kernel Rockchip Raster Graphic Acceleration (RGA) media driver. The vulnerable code path allows rga_get_frame() to return an encoded error pointer, such as ERR_PTR(-EINVAL), when an unsupported or invalid buffer type is supplied. rga_buf_init() fails to validate that return value before dereferencing it to access frame metadata, causing an invalid pointer dereference in kernel context. A local user or process with access to the affected RGA/media device interface can trigger a kernel crash or oops, resulting in loss of system availability. The issue does not directly provide confidentiality or integrity impact based on the published description.

Why it matters to the business

Systems using affected Linux kernels on Rockchip-based platforms may be vulnerable to local crashes caused by low-privileged users or compromised local applications. In embedded, appliance, kiosk, IoT, media-processing, or edge deployments, this can cause service interruption, device reboot loops, degraded availability, or operational downtime. Because the vulnerability is not in CISA KEV, has very low EPSS, and has no known public exploit maturity, broad internet-scale exploitation is unlikely; however, organizations that expose local media device access to untrusted workloads should treat it as an availability risk.

How an attack unfolds

An attacker first needs local execution on a system running an affected Linux kernel with the Rockchip RGA driver present and accessible. The attacker then interacts with the relevant media/RGA device interface and submits a request using an invalid or unsupported buffer type. The driver calls rga_get_frame(), which returns an error pointer rather than a valid frame structure. The vulnerable rga_buf_init() path then dereferences that error pointer while accessing the frame size field. Because this occurs in kernel context, the dereference can produce a kernel oops, panic, driver failure, or system crash, denying service to legitimate users and workloads.

How to fix it

Upgrade to a Linux kernel build that includes the upstream fix for the Rockchip RGA driver, specifically the change that adds proper ERR_PTR validation in rga_buf_init() before dereferencing the frame pointer. If vendor fixed kernel package versions are available for the distribution, device BSP, appliance firmware, or embedded platform, deploy those updates through the normal kernel or firmware update process. Where immediate patching is not possible, reduce exposure by disabling or unloading the Rockchip RGA driver if it is not required, restricting access to the relevant media/RGA device nodes to trusted users only, avoiding assignment of those devices into untrusted containers or sandboxes, and applying device cgroup, udev, AppArmor, SELinux, or container runtime controls to prevent untrusted processes from reaching the driver.

How to confirm the fix worked

Confirm remediation by verifying that the running kernel or vendor firmware includes the patched Rockchip RGA driver code path with ERR_PTR checking in rga_buf_init(). Check the active kernel version and vendor changelog, and confirm that the deployed package or firmware release contains the CVE fix. On systems built from source, inspect the driver code to ensure rga_buf_init() checks IS_ERR() or equivalent on the return value from rga_get_frame() before accessing frame fields. Validate exposure reduction by confirming whether the Rockchip RGA driver is loaded, whether related device nodes exist, and whether untrusted users or containers can access them. After patching, monitor kernel logs while exercising normal RGA/media workloads to ensure there are no new oops, panic, or invalid pointer dereference messages involving rga_buf_init(), rga_get_frame(), or the Rockchip RGA driver.

Typical attack path

1. Gain local code execution or access to an untrusted local workload on a Rockchip-based Linux system.
2. Confirm that the Rockchip RGA/media driver is loaded and that the process can open the exposed device node or media interface.
3. Submit a crafted RGA/media operation using an invalid or unsupported buffer type.
4. Trigger rga_get_frame() to return ERR_PTR(-EINVAL).
5. Cause rga_buf_init() to dereference the error pointer when accessing frame metadata.
6. Crash the kernel, panic the system, or disrupt the driver, resulting in denial of service.

How to detect it

To determine whether this was already exploited, review kernel and system logs for crashes or oops events involving the Rockchip RGA driver and the functions rga_buf_init() or rga_get_frame(). Useful sources include dmesg output, journald kernel logs, /var/log/kern.log, /var/log/messages, crash dump infrastructure such as kdump/vmcore, pstore/ramoops on embedded systems, and device watchdog reboot records. Look for repeated kernel faults following access to media or RGA device nodes, unexpected system reboots, kernel panic traces referencing Rockchip RGA, or invalid pointer dereferences near encoded error-pointer addresses. Correlate any crashes with local user sessions, container workloads, multimedia processing jobs, or applications that had access to RGA/media devices. This vulnerability does not produce a reliable remote network indicator; detection is primarily host-based through kernel crash artifacts and device access auditing.

• rga_buf_init
• rga_get_frame
• rockchip.*rga
• Rockchip RGA
• Unable to handle kernel paging request
• BUG: kernel NULL pointer dereference
• Oops:
• Kernel panic - not syncing
• general protection fault
• invalid pointer dereference
• ERR_PTR(-EINVAL)
• ffffffffffffffea
• /dev/rga
• /dev/video
• /dev/media
• rga:

What your security team should do

• Inventory Rockchip-based Linux systems, embedded devices, appliances, and edge nodes that use the Rockchip RGA media driver.
• Prioritize patching systems where untrusted local users, applications, containers, or media-processing workloads can access RGA/media device interfaces.
• Apply vendor kernel, firmware, or BSP updates that include the upstream ERR_PTR validation fix for the Rockchip RGA driver.
• If patching is delayed, restrict permissions on RGA/media device nodes and prevent device passthrough into untrusted containers or virtualized workloads.
• Disable or unload the Rockchip RGA driver where hardware acceleration is not operationally required.
• Monitor kernel logs for oops, panic, invalid pointer dereference, or RGA driver crash messages that could indicate attempted triggering.
• Because KEV status is false, ransomware use is not reported, EPSS is very low, and exploit maturity is listed as none, handle this as a targeted local availability issue rather than an urgent internet-facing exploitation event.