CVE-2026-89879
In the Linux kernel, the following vulnerability has been resolved: media: s2255: bound JPEG frame size before copying into the buffer s2255_fillbuff() memcpy()s vc->jpg_size bytes of a captured JPEG/MJPEG frame into the vb2 plane. vc->jpg_size is taken verbatim from the S2255_MARKER_FRAME header the device sends (pdword[4] in save_frame()) and, unlike the frame payload length just above it, is never bounded: payload = le32_to_cpu(pdword[3]); if (payload > vc->req_image_size) /* payload is checked ... */ return -EINVAL; vc->pkt_size = payload; vc->jpg_size = le32_to_cpu(pdword[4]); /* ... jpg_size is not */ A malicious or malfunctioning device can therefore report a jpg_size larger than the destination vb2 plane, and the memcpy() writes past it. jpg_size is a signed int, so a value with the top bit set also turns into a huge length. Reject a frame whose jpg_size is negative or exceeds the plane size before copying it.
Affected versions
Linux kernel versions
2.6.27
and later are affected. Fixed in
5.10.270,
5.15.221,
6.1.188,
6.6.157,
6.12.110,
6.18.51,
7.2.5,
7.3-rc1
and their respective stable series.
References
8 totalFrequently asked questions
-
What is CVE-2026-89879?
CVE-2026-89879 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 2.6.27 onward and has been patched in 5.10.270, 5.15.221, 6.1.188 and others. CVE-2026-89879 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
Is there a patch available for CVE-2026-89879?
Yes. CVE-2026-89879 has been patched. Fixed versions include 5.10.270, 5.15.221, 6.1.188 and others. If you are running Linux kernel 2.6.27 or later up to the fix versions, apply the relevant patch for your kernel branch.
-
Is CVE-2026-89879 actively exploited?
No. CVE-2026-89879 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.