CVE-2026-89879

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

media: s2255: bound JPEG frame size before copying into the buffer

s2255_fillbuff() memcpy()s vc->jpg_size bytes of a captured JPEG/MJPEG

frame into the vb2 plane. vc->jpg_size is taken verbatim from the

S2255_MARKER_FRAME header the device sends (pdword[4] in save_frame())

and, unlike the frame payload length just above it, is never bounded:

payload = le32_to_cpu(pdword[3]);

if (payload > vc->req_image_size) /* payload is checked ... */

return -EINVAL;

vc->pkt_size = payload;

vc->jpg_size = le32_to_cpu(pdword[4]); /* ... jpg_size is not */

A malicious or malfunctioning device can therefore report a jpg_size

larger than the destination vb2 plane, and the memcpy() writes past it.

jpg_size is a signed int, so a value with the top bit set also turns

into a huge length.

Reject a frame whose jpg_size is negative or exceeds the plane size

before copying it.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References