CVE-2026-68230

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-68230", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-30T09:28:09.376Z", "datePublished": "2026-08-10T12:00:53.425Z", "dateUpdated": "2026-08-17T05:01:18.566Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-17T05:01:18.566Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: amlogic-c3: Add validations for ae and awb config\n\nAvoid invalid memory access if the zones_num is bigger than\nzone_weight.\n\nThis patch fixes the following smatch errors:\ndrivers/media/platform/amlogic/c3/isp/c3-isp-params.c:111 c3_isp_params_awb_wt() error: buffer overflow 'cfg->zone_weight' 768 <= u32max\ndrivers/media/platform/amlogic/c3/isp/c3-isp-params.c:111 c3_isp_params_awb_wt() error: buffer overflow 'cfg->zone_weight' 768 <= u32max\ndrivers/media/platform/amlogic/c3/isp/c3-isp-params.c:227 c3_isp_params_ae_wt() error: buffer overflow 'cfg->zone_weight' 255 <= u32max\ndrivers/media/platform/amlogic/c3/isp/c3-isp-params.c:227 c3_isp_params_ae_wt() error: buffer overflow 'cfg->zone_weight' 255 <= u32max"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H", "baseScore": 7.3, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerability is reached only through the local V4L2 meta-output device node of the Amlogic C3 ISP driver, by opening /dev/videoX and issuing VIDIOC_QBUF plus VIDIOC_STREAMON ioctls. No network or adjacent-network path exists.\nAC:L - Both horiz_zones_num and vert_zones_num are copied verbatim from the queued parameters buffer with no validation, so setting them to 0xff deterministically produces a ~64KB out-of-bounds read on every stream start. No race, timing, or memory-layout condition is involved.\nPR:L - The attacker only needs read/write access to the ISP parameters video node (typically group video, or the camera service/HAL user on Android-class devices); no CAP_SYS_ADMIN or root is required, and every ioctl on the path is unprivileged.\nUI:N - The attacking process queues the malformed parameter buffer and starts streaming entirely on its own; no action by any other user or victim process is needed.\nS:U - The out-of-bounds access occurs in kernel memory within the same security authority as the kernel itself; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - zones_num can reach 255*255=65025 against a 255-byte (AE) or 768-byte (AWB) array inside a ~1.7KB kvmalloc buffer, so up to ~64KB of adjacent kernel heap is read out of bounds and pushed into device state \u2014 a large, attacker-positioned disclosure of kernel memory rather than a few strictly bounded bytes.\nI:L - The loop performs thousands of writes (up to 8128 register writes) of out-of-bounds heap data into the auto-incrementing AE/AWB weight LUT, far beyond its 32/96-entry depth, corrupting ISP hardware configuration and the statistics delivered to userspace; no arbitrary kernel memory write is available.\nA:H - Reading ~64KB past the end of a slab object can hit an unmapped or poisoned page and oops; the same code runs from c3_isp_params_isr() in interrupt context under spinlock_irqsave, where a fault reliably results in a kernel panic, and it is also an immediate KASAN slab-out-of-bounds."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/media/platform/amlogic/c3/isp/c3-isp-params.c"], "versions": [{"version": "fb2e135208f364f26b7579c191434d38655e813f", "lessThan": "391fe3e36e59f3c6e3d46edfb3a5de51e00cd216", "status": "affected", "versionType": "git"}, {"version": "fb2e135208f364f26b7579c191434d38655e813f", "lessThan": "32cbe5474e74817aa8a576b94135cc45e59f5e07", "status": "affected", "versionType": "git"}, {"version": "fb2e135208f364f26b7579c191434d38655e813f", "lessThan": "9724164f71974a2a44a5e026614fbcc05bab6d91", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/media/platform/amlogic/c3/isp/c3-isp-params.c"], "versions": [{"version": "6.16", "status": "affected"}, {"version": "0", "lessThan": "6.16", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.42", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.6", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16", "versionEndExcluding": "6.18.42"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16", "versionEndExcluding": "7.1.6"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/391fe3e36e59f3c6e3d46edfb3a5de51e00cd216"}, {"url": "https://git.kernel.org/stable/c/32cbe5474e74817aa8a576b94135cc45e59f5e07"}, {"url": "https://git.kernel.org/stable/c/9724164f71974a2a44a5e026614fbcc05bab6d91"}], "title": "media: amlogic-c3: Add validations for ae and awb config", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/media/platform/amlogic/c3/isp/c3-isp-params.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "391fe3e36e59f3c6e3d46edfb3a5de51e00cd216", "status": "affected", "version": "fb2e135208f364f26b7579c191434d38655e813f", "versionType": "git"}, {"lessThan": "32cbe5474e74817aa8a576b94135cc45e59f5e07", "status": "affected", "version": "fb2e135208f364f26b7579c191434d38655e813f", "versionType": "git"}, {"lessThan": "9724164f71974a2a44a5e026614fbcc05bab6d91", "status": "affected", "version": "fb2e135208f364f26b7579c191434d38655e813f", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/media/platform/amlogic/c3/isp/c3-isp-params.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.16"}, {"lessThan": "6.16", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.42", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.6", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: amlogic-c3: Add validations for ae and awb config\n\nAvoid invalid memory access if the zones_num is bigger than\nzone_weight.\n\nThis patch fixes the following smatch errors:\ndrivers/media/platform/amlogic/c3/isp/c3-isp-params.c:111 c3_isp_params_awb_wt() error: buffer overflow 'cfg->zone_weight' 768 <= u32max\ndrivers/media/platform/amlogic/c3/isp/c3-isp-params.c:111 c3_isp_params_awb_wt() error: buffer overflow 'cfg->zone_weight' 768 <= u32max\ndrivers/media/platform/amlogic/c3/isp/c3-isp-params.c:227 c3_isp_params_ae_wt() error: buffer overflow 'cfg->zone_weight' 255 <= u32max\ndrivers/media/platform/amlogic/c3/isp/c3-isp-params.c:227 c3_isp_params_ae_wt() error: buffer overflow 'cfg->zone_weight' 255 <= u32max"}], "id": "CVE-2026-68230", "lastModified": "2026-08-17T05:18:25.280", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.5, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-08-10T13:20:11.250", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/32cbe5474e74817aa8a576b94135cc45e59f5e07"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/391fe3e36e59f3c6e3d46edfb3a5de51e00cd216"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/9724164f71974a2a44a5e026614fbcc05bab6d91"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: media: amlogic-c3: Add validations for ae and awb config", "id": "2513423", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2513423"}, "csaw": false, "cwe": "CWE-787", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nmedia: amlogic-c3: Add validations for ae and awb config\nAvoid invalid memory access if the zones_num is bigger than\nzone_weight.\nThis patch fixes the following smatch errors:\ndrivers/media/platform/amlogic/c3/isp/c3-isp-params.c:111 c3_isp_params_awb_wt() error: buffer overflow 'cfg->zone_weight' 768 <= u32max\ndrivers/media/platform/amlogic/c3/isp/c3-isp-params.c:111 c3_isp_params_awb_wt() error: buffer overflow 'cfg->zone_weight' 768 <= u32max\ndrivers/media/platform/amlogic/c3/isp/c3-isp-params.c:227 c3_isp_params_ae_wt() error: buffer overflow 'cfg->zone_weight' 255 <= u32max\ndrivers/media/platform/amlogic/c3/isp/c3-isp-params.c:227 c3_isp_params_ae_wt() error: buffer overflow 'cfg->zone_weight' 255 <= u32max", "A flaw was found in the Linux kernel's `media: amlogic-c3` driver. This vulnerability arises from improper validation of automatic white balance (AWB) and automatic exposure (AE) configuration parameters. Specifically, the driver does not correctly check the number of zones against the allocated memory for zone weights, leading to invalid memory access. This can result in a buffer overflow, which may allow an attacker to corrupt memory and potentially impact system stability or integrity."], "name": "CVE-2026-68230", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-10T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-68230\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-68230\nhttps://lore.kernel.org/linux-cve-announce/2026081016-CVE-2026-68230-9c59@gregkh/T"]}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[fb2e135208f364f26b7579c191434d38655e813f,391fe3e36e59f3c6e3d46edfb3a5de51e00cd216)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[fb2e135208f364f26b7579c191434d38655e813f,32cbe5474e74817aa8a576b94135cc45e59f5e07)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[fb2e135208f364f26b7579c191434d38655e813f,9724164f71974a2a44a5e026614fbcc05bab6d91)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "calver", "value": "6.16"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.16)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.42,6.19.0]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.6,7.2.0]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2-rc1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-10T15:00:03.822317+00:00", "updated": "2026-08-14T01:30:04.466677+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}