CVE-2026-89878: media: s2255: check firmware size before reading trailing marker
In the Linux kernel, the following vulnerability has been resolved:
media: s2255: check firmware size before reading trailing marker
s2255probe() reads a 4-byte marker and version from the last 8 bytes of the firmware blob (fw->data[fwsize - 8] and [fwsize - 4]). If the firmware file is shorter than 8 bytes, fwsize - 8 underflows and the access reads out of bounds. Validate the firmware size before indexing.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Validate the firmware size before indexing/trailing-marker reads in media: s2255 (ensure fw_size is checked before accessing fw->data[fw_size - 8] and fw->data[fw_size - 4]); this prevents out-of-bounds reads when the firmware file is shorter than 8 bytes.
Event History
Frequently Asked Questions
What conditions are required to trigger the out-of-bounds read?
The s2255 driver must probe using a firmware blob shorter than 8 bytes. During probing, it reads data relative to the end of that blob, so a too-short file causes the size calculation to underflow and indexes outside the firmware buffer.
How can I determine whether a system may be exposed?
Check whether the Linux kernel is using the s2255 media driver and whether the firmware supplied to it could be truncated or otherwise shorter than 8 bytes. The issue is specifically associated with firmware handling during s2255_probe().
What is the practical mitigation before an updated kernel is deployed?
Ensure that firmware provided to the s2255 driver is valid and at least 8 bytes long. Avoid deploying truncated or malformed firmware files for this device.