CVE-2026-89878

media: s2255: check firmware size before reading trailing marker

Published Sep 16, 2026 CVSS n/a EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

media: s2255: check firmware size before reading trailing marker

s2255_probe() reads a 4-byte marker and version from the last 8 bytes
of the firmware blob (fw->data[fw_size - 8] and [fw_size - 4]). If the
firmware file is shorter than 8 bytes, fw_size - 8 underflows and the
access reads out of bounds. Validate the firmware size before indexing.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`14d962602c8bf86e63c9b9272be1f0360d0a448a`	affected	< 6f6a5b0b0a84c2de0e152f2841e57bc226db924f
`14d962602c8bf86e63c9b9272be1f0360d0a448a`	affected	< 8eca0f85eeb0789be40e637bcf9a21c4265b6c6f
`14d962602c8bf86e63c9b9272be1f0360d0a448a`	affected	< ffc27411ea60b8a09f1fea3d664b65210fdeb454
`14d962602c8bf86e63c9b9272be1f0360d0a448a`	affected	< 5626785b0e4665326e4d96736c106161da09b2f0
`14d962602c8bf86e63c9b9272be1f0360d0a448a`	affected	< 3e03f1209c1c8a45a7bc559f4ecd79d9b33f706d
`14d962602c8bf86e63c9b9272be1f0360d0a448a`	affected	< 342632a4d8ba3fafc1556deee0b7a48dd7860336
`14d962602c8bf86e63c9b9272be1f0360d0a448a`	affected	< 7d221859ba45d7228d0138c9a3e55bd3bb31e14e
`14d962602c8bf86e63c9b9272be1f0360d0a448a`	affected	< 330f2936ab768c7215322a476f033143e8891d28

Linux

affected

Version	Status	Constraints
`2.6.28`	affected	—
`0`	unaffected	< 2.6.28
`5.10.270`	unaffected	≤ 5.10.*
`5.15.221`	unaffected	≤ 5.15.*
`6.1.188`	unaffected	≤ 6.1.*
`6.6.157`	unaffected	≤ 6.6.*
`6.12.110`	unaffected	≤ 6.12.*
`6.18.51`	unaffected	≤ 6.18.*
`7.2.5`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[14d962602c8bf86e63c9b9272be1f0360d0a448a,6f6a5b0b0a84c2de0e152f2841e57bc226db924f)`	affected	code_commit	—
`[14d962602c8bf86e63c9b9272be1f0360d0a448a,8eca0f85eeb0789be40e637bcf9a21c4265b6c6f)`	affected	code_commit	—
`[14d962602c8bf86e63c9b9272be1f0360d0a448a,ffc27411ea60b8a09f1fea3d664b65210fdeb454)`	affected	code_commit	—
`[14d962602c8bf86e63c9b9272be1f0360d0a448a,5626785b0e4665326e4d96736c106161da09b2f0)`	affected	code_commit	—
`[14d962602c8bf86e63c9b9272be1f0360d0a448a,3e03f1209c1c8a45a7bc559f4ecd79d9b33f706d)`	affected	code_commit	—
`[14d962602c8bf86e63c9b9272be1f0360d0a448a,342632a4d8ba3fafc1556deee0b7a48dd7860336)`	affected	code_commit	—
`[14d962602c8bf86e63c9b9272be1f0360d0a448a,7d221859ba45d7228d0138c9a3e55bd3bb31e14e)`	affected	code_commit	—
`[14d962602c8bf86e63c9b9272be1f0360d0a448a,330f2936ab768c7215322a476f033143e8891d28)`	affected	code_commit	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`2.6.28`	affected	semver	—
`[0,2.6.28)`	unaffected	semver	—
`[5.10.270,5.11.0)`	unaffected	semver	—
`[5.15.221,5.16.0)`	unaffected	semver	—
`[6.1.188,6.2.0)`	unaffected	semver	—
`[6.6.157,6.7.0)`	unaffected	semver	—
`[6.12.110,6.13.0)`	unaffected	semver	—
`[6.18.51,6.19.0)`	unaffected	semver	—
`[7.2.5,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4817-1	linux-6.12 security update
Debian DLA	DLA-4841-1	linux security update
Debian DSA	DSA-6528-1	linux security update
Ubuntu USN	USN-8961-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9019-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9020-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9022-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9023-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9024-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9025-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9026-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9029-1	Linux kernel (Raspberry Pi) vulnerabilities
Ubuntu USN	USN-9039-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-9040-1	Linux kernel (Low Latency NVIDIA) vulnerabilities
Ubuntu USN	USN-9066-1	Linux kernel (HWE) vulnerabilities
Ubuntu USN	USN-9091-1	Linux kernel (NVIDIA Tegra) vulnerabilities

Metrics

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.216% probability within 30 days)

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/330f2936ab768c7215322a476f033143e8891d28
https://git.kernel.org/stable/c/342632a4d8ba3fafc1556deee0b7a48dd7860336
https://git.kernel.org/stable/c/3e03f1209c1c8a45a7bc559f4ecd79d9b33f706d
https://git.kernel.org/stable/c/5626785b0e4665326e4d96736c106161da09b2f0
https://git.kernel.org/stable/c/6f6a5b0b0a84c2de0e152f2841e57bc226db924f
https://git.kernel.org/stable/c/7d221859ba45d7228d0138c9a3e55bd3bb31e14e
https://git.kernel.org/stable/c/8eca0f85eeb0789be40e637bcf9a21c4265b6c6f
https://git.kernel.org/stable/c/ffc27411ea60b8a09f1fea3d664b65210fdeb454

History

Sep 18, 2026 8:45 AM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-680

Sep 16, 2026 10:45 AM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: media: s2255: check firmware size before reading trailing marker s2255_probe() reads a 4-byte marker and version from the last 8 bytes of the firmware blob (fw->data[fw_size - 8] and [fw_size - 4]). If the firmware file is shorter than 8 bytes, fw_size - 8 underflows and the access reads out of bounds. Validate the firmware size before indexing.
Title		media: s2255: check firmware size before reading trailing marker
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/330f2936ab768c7215322a476f033143e8891d28 https://git.kernel.org/stable/c/342632a4d8ba3fafc1556deee0b7a48dd7860336 https://git.kernel.org/stable/c/3e03f1209c1c8a45a7bc559f4ecd79d9b33f706d https://git.kernel.org/stable/c/5626785b0e4665326e4d96736c106161da09b2f0 https://git.kernel.org/stable/c/6f6a5b0b0a84c2de0e152f2841e57bc226db924f https://git.kernel.org/stable/c/7d221859ba45d7228d0138c9a3e55bd3bb31e14e https://git.kernel.org/stable/c/8eca0f85eeb0789be40e637bcf9a21c4265b6c6f https://git.kernel.org/stable/c/ffc27411ea60b8a09f1fea3d664b65210fdeb454