CVE-2026-89878

A flaw was found in the Linux kernel's s2255 media driver. The driver attempts to read a trailing marker and version from the end of a firmware blob without properly validating the firmware file's size. A local attacker could provide a specially crafted firmware file shorter than 8 bytes, leading to an out-of-bounds read. This could potentially result in a denial of service or information disclosure.

Red Hat has evaluated this vulnerability as Moderate severity because successful exploitation requires local access, physical or virtual connection of a specialized Sensoray 2255 USB device, and an undersized firmware image. In standard Red Hat Enterprise Linux environments, this hardware driver is not active by default and only initializes when matching capture devices are attached. Additionally, substituting or placing invalid firmware files in system directories normally demands administrative privileges, substantially constraining the blast radius to a localized denial of service.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.