CVE-2026-89879

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the s2255 fillbuff() function where the memcpy() operation uses the vc->jpg size variable to copy captured JPEG/MJPEG frames into the vb2 plane. The vc->jpg size value is taken directly from the S2255 MARKER FRAME header sent by the device without being bounded. Because jpg size is a signed integer, a malicious or malfunctioning device could provide a negative value or a value exceeding the destination buffer size, leading to a memory write past the buffer boundary.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.