CVE-2026-89879

A flaw was found in the Linux kernel's s2255 media driver. The driver fails to properly validate the size of JPEG frames received from a device. A malicious or malfunctioning device can provide an oversized jpg_size value, causing a buffer overflow when the data is copied. This could allow an attacker to corrupt memory, potentially leading to a denial of service or other system instability.

A kernel out-of-bounds write exists in the s2255 USB media driver because s2255_fillbuff() copies jpg_size bytes into a vb2 plane without first bounding jpg_size against the destination plane size. The jpg_size value is taken from the JPEG/MJPEG frame header provided by the device, while only the separate payload length was validated. A malicious or malfunctioning Sensoray 2255 compatible USB device can report a negative or oversized JPEG frame size and make memcpy() write past the video buffer. For the CVSS the PR:N is used because the malicious device does not need privileges on the target system once it can present crafted frame metadata. The issue is not network reachable and is best modeled as AV:P because exploitation normally requires physical access to attach a malicious USB device or control over an already attached capture device. Impact is at least denial of service via kernel crash and in the paranoid case may include confidentiality and integrity impact due to device controlled kernel memory corruption.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.