CVE-2026-89879: media: s2255: bound JPEG frame size before copying into the buffer
In the Linux kernel, the following vulnerability has been resolved:
media: s2255: bound JPEG frame size before copying into the buffer
s2255fillbuff() memcpy()s vc->jpgsize bytes of a captured JPEG/MJPEG frame into the vb2 plane. vc->jpgsize is taken verbatim from the S2255MARKERFRAME header the device sends (pdword[4] in saveframe()) and, unlike the frame payload length just above it, is never bounded:
payload = le32tocpu(pdword[3]); if (payload > vc->reqimagesize) / payload is checked ... / return -EINVAL; vc->pktsize = payload; vc->jpgsize = le32tocpu(pdword[4]); / ... jpgsize is not /
A malicious or malfunctioning device can therefore report a jpgsize larger than the destination vb2 plane, and the memcpy() writes past it. jpgsize is a signed int, so a value with the top bit set also turns into a huge length.
Reject a frame whose jpgsize is negative or exceeds the plane size before copying it.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In s2255 frame handling (S2255_MARKER_FRAME header handling in save_frame()/s2255_fillbuff()), validate jpg_size (le32_to_cpu(pdword[4])) and reject the frame with -EINVAL if jpg_size is negative or greater than the destination vb2 plane size, before copying memcpy() into the vb2 plane.
Linux kernel media: s2255 Reject a frame when jpg_size is negative or exceeds the plane size = return -EINVAL
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems using the Linux kernel s2255 media driver and receiving JPEG/MJPEG frames from an S2255 device are exposed. The issue can be triggered by a malicious or malfunctioning device that supplies a crafted frame header.
What must an attacker control to exploit it?
The attacker needs to cause the device to report a S2255_MARKER_FRAME header with a jpg_size value that is negative or larger than the destination vb2 plane. The payload length check does not constrain this separate jpg_size field.
How can this be mitigated if an update cannot be applied immediately?
Do not use or connect untrusted S2255 devices, and avoid capturing JPEG/MJPEG frames from devices suspected of being malformed or malicious. The vulnerable copy occurs while handling captured JPEG/MJPEG frame data.
How do I determine whether a system is affected?
Check whether the running kernel uses the s2255 media driver and handles JPEG/MJPEG capture from an S2255 device. The supplied fixed changes reject frames when jpg_size is negative or exceeds the vb2 plane size before copying.