CVE-2026-89878

Not scored yetLast modified Oct 19, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

media: s2255: check firmware size before reading trailing marker

s2255_probe() reads a 4-byte marker and version from the last 8 bytes of the firmware blob (fw->data[fw_size - 8] and [fw_size - 4]). If the firmware file is shorter than 8 bytes, fw_size - 8 underflows and the access reads out of bounds. Validate the firmware size before indexing.

Metrics

No CVSS score has been published yet.

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
LinuxLinux>= 14d962602c8bf86e63c9b9272be1f0360d0a448a, < 6f6a5b0b0a84c2de0e152f2841e57bc226db924f; >= 14d962602c8bf86e63c9b9272be1f0360d0a448a, < 8eca0f85eeb0789be40e637bcf9a21c4265b6c6f; >= 14d962602c8bf86e63c9b9272be1f0360d0a448a, < ffc27411ea60b8a09f1fea3d664b65210fdeb454; >= 14d962602c8bf86e63c9b9272be1f0360d0a448a, < 5626785b0e4665326e4d96736c106161da09b2f0; >= 14d962602c8bf86e63c9b9272be1f0360d0a448a, < 3e03f1209c1c8a45a7bc559f4ecd79d9b33f706d; >= 14d962602c8bf86e63c9b9272be1f0360d0a448a, < 342632a4d8ba3fafc1556deee0b7a48dd7860336; >= 14d962602c8bf86e63c9b9272be1f0360d0a448a, < 7d221859ba45d7228d0138c9a3e55bd3bb31e14e; >= 14d962602c8bf86e63c9b9272be1f0360d0a448a, < 330f2936ab768c7215322a476f033143e8891d28
LinuxLinux2.6.28

References

Timeline

Published
Sep 16, 2026
Last modified
Oct 19, 2026
NVD status
Received

Related CVEs from 2026

CVE-2026-89879In the Linux kernel, the following vulnerability has been resolved: media: s2255: bound JPEG frame size before copying into the buffer s22CVE-2026-89886.8Autel Maxi Charger Single firmware through V1.03.51 exposes an accessible UART interface that permits interruption of the boot process and aCVE-2026-898807.8In the Linux kernel, the following vulnerability has been resolved: media: rtl2832_sdr: release URBs and stream buffers on start_streaming(CVE-2026-89881In the Linux kernel, the following vulnerability has been resolved: media: rtl2832_sdr: use vb2_video_unregister_device() on remove to fix CVE-2026-898827.8In the Linux kernel, the following vulnerability has been resolved: media: rkvdec: hevc: guard INTER_REF_PIC_SET_PRED index underflow st_rCVE-2026-898837.8In the Linux kernel, the following vulnerability has been resolved: media: rc: sunxi-cir: Unregister rc device on probe failure After rc_rCVE-2026-89884In the Linux kernel, the following vulnerability has been resolved: media: platform: mtk-mdp3: fix NULL deref on failed SCP lookup Add theCVE-2026-898858.4In the Linux kernel, the following vulnerability has been resolved: media: platform: mtk-mdp3: Fix SCP device refcounting mdp_probe() firsCVE-2026-89886In the Linux kernel, the following vulnerability has been resolved: media: intel/ipu6: fix async notifier cleanup leak on parse error isysCVE-2026-898877.8In the Linux kernel, the following vulnerability has been resolved: media: i2c: ov7740: fix use-after-destroy in remove The ov7740_remove(CVE-2026-898887.8In the Linux kernel, the following vulnerability has been resolved: media: i2c: ov02a10: fix endpoint parsing use-after-free The ov02a10_cCVE-2026-89889In the Linux kernel, the following vulnerability has been resolved: media: i2c: imx415: Release runtime PM reference on VBLANK error The V
CVE-2026-89878: Unscored | Vulnix