Executive brief
A vulnerability was identified in the Linux kernel's Xbox DVD Movie Playback Kit driver. The driver incorrectly handled memory buffers used for hardware communication, which could lead to data corruption or system instability. This affects systems using this specific hardware kit, potentially impacting the reliability of the operating system.
Technical details
A vulnerability in the Linux kernel's media/rc/xbox_remote.c driver stems from a violation of DMA coherency rules. The driver's IO buffer (`inbuf`) was previously defined as part of the `xbox_remote` device structure. On certain architectures or memory configurations, this can lead to cache coherency issues where the CPU and the DMA controller have inconsistent views of the memory. An attacker with local access or the ability to trigger hardware interactions could potentially exploit this for memory corruption or system instability. The fix involves dynamically allocating the buffer separately using `kzalloc` to ensure it meets DMA alignment and coherency requirements.
Affected products
- Linux Linux Kernel All versions including and prior to 6.x series
Timeline
- 2026-02-11: other: Patch authored
- 2026-05-28: disclosed: CVE published
- 2026-05-28: advisory: NVD advisory published
References
- https://git.kernel.org/stable/c/0bd8ac88ec5f74cd0f4b8cfc54f4cc0827007249
- https://git.kernel.org/stable/c/0cc9251833bf02c8c7863404157c94dab5928fcf
- https://git.kernel.org/stable/c/48a668c22e8f92637bc496e84d1cf06900f74a5c
- https://git.kernel.org/stable/c/63a960b39de9c51f29ca19aa5067934f865c0bc7
- https://git.kernel.org/stable/c/e280d1e5e3f2595bbb43fe6e1bce00c59a43c0ff