CVE-2026-89879
Description
In the Linux kernel, the following vulnerability has been resolved: media: s2255: bound JPEG frame size before copying into the buffer s2255_fillbuff() memcpy()s vc->jpg_size bytes of a captured JPEG/MJPEG frame into the vb2 plane. vc->jpg_size is taken verbatim from the S2255_MARKER_FRAME header the device sends (pdword[4] in save_frame()) and, unlike the frame payload length just above it, is never bounded: payload = le32_to_cpu(pdword[3]); if (payload > vc->req_image_size) /* payload is checked ... */ return -EINVAL; vc->pkt_size = payload; vc->jpg_size = le32_to_cpu(pdword[4]); /* ... jpg_size is not */ A malicious or malfunctioning device can therefore report a jpg_size larger than the destination vb2 plane, and the memcpy() writes past it. jpg_size is a signed int, so a value with the top bit set also turns into a huge length. Reject a frame whose jpg_size is negative or exceeds the plane size before copying it.
How to fix
- Linux Linux32a595dd3e8634544e5cfbc47f906dff3d3c1ef8, 4b6f7bccc6559ae5c54573c284fe76eafc9989b2, 2542516a147bfad740e7e411c251b639fad260ff, 79f58f900dd221ab04ea74bf4eaf79fa3b0fcc77, d2ecaaab6a4f165abb54cdf61be60030b5782bf8, 68d664f1b4efe525e99154b7058fcb0378bdaff7, dd739517560c8d0ec4463a53e717bf40b988d7da, e504cc888f42999dd76b6a43788c422610f2aad2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | 38f993ad8b1fe4caf9e989caf6e2a25aff3bbaf7 ≤ v < 32a595dd3e8634544e5cfbc47f906dff3d3c1ef8, 38f993ad8b1fe4caf9e989caf6e2a25aff3bbaf7 ≤ v < 4b6f7bccc6559ae5c54573c284fe76eafc9989b2, 38f993ad8b1fe4caf9e989caf6e2a25aff3bbaf7 ≤ v < 2542516a147bfad740e7e411c251b639fad260ff, 38f993ad8b1fe4caf9e989caf6e2a25aff3bbaf7 ≤ v < 79f58f900dd221ab04ea74bf4eaf79fa3b0fcc77, 38f993ad8b1fe4caf9e989caf6e2a25aff3bbaf7 ≤ v < d2ecaaab6a4f165abb54cdf61be60030b5782bf8, 38f993ad8b1fe4caf9e989caf6e2a25aff3bbaf7 ≤ v < 68d664f1b4efe525e99154b7058fcb0378bdaff7, 38f993ad8b1fe4caf9e989caf6e2a25aff3bbaf7 ≤ v < dd739517560c8d0ec4463a53e717bf40b988d7da, 38f993ad8b1fe4caf9e989caf6e2a25aff3bbaf7 ≤ v < e504cc888f42999dd76b6a43788c422610f2aad2, 2.6.27 | 32a595dd3e8634544e5cfbc47f906dff3d3c1ef8, 4b6f7bccc6559ae5c54573c284fe76eafc9989b2, 2542516a147bfad740e7e411c251b639fad260ff, 79f58f900dd221ab04ea74bf4eaf79fa3b0fcc77, d2ecaaab6a4f165abb54cdf61be60030b5782bf8, 68d664f1b4efe525e99154b7058fcb0378bdaff7, dd739517560c8d0ec4463a53e717bf40b988d7da, e504cc888f42999dd76b6a43788c422610f2aad2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.