How does the exploit work? Can it be executed remotely, even via prepared websites or is access to the Hardware required?
Which means, unfortunately, that playing a video file with that particular driver is all that would be needed.
The constructed video file would need a second exploit to jump out of the virtual memory of the driver and into the kernel, but that has happened before [1]. It's a high risk. Or it could just be used to crash every device that sees the video in a DoS attack.
However, the devices that use those drivers tend not to be end-user devices (webcams, smart TVs, TV tuners, recorders, etc.) They would be used as an entrypoint, before moving laterally into a network. So, standard IoT type breach.
[0] https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux...
So, maybe you can exploit it by connecting a camera to the USB port? That would be bad enough. But this code only seems to be called if a video stream is active. So things like unlocking a locked phone seems improbable to be possible.
You could try to initiate a video call with the locked device, though.