Executive brief
The Linux kernel's vicodec (video codec) driver contains a buffer overflow vulnerability in the FWHT video encoder. When encoding certain 4-component video formats with uncompressible data, the encoder writes more data to a capture buffer than allocated, corrupting adjacent kernel memory. This could allow a local attacker to crash the system or execute code with kernel privileges.
Technical details
The vulnerability is a heap buffer overflow in the vicodec FWHT encoder. The root cause is undersizing of the capture buffer; vidioc_s_fmt_vid_out() allocates a buffer based on sizeimage_mult of 3, but fwht_encode_frame() can write up to 4 planes worth of data when all four planes use the uncompressed fallback path (FWHT_FRAME_UNENCODED). For 4-component formats where all planes are full resolution (width_div == height_div == 1), this results in writing sizeof(struct fwht_cframe_hdr) + 4 * coded_w * coded_h bytes, overrunning the allocated buffer by coded_w * coded_h bytes. The fix increases pixfmt_fwht.sizeimage_mult from 3 to 4. Attack vector is local (user must set format via ioctl); no network attack possible. Patch is available in Linux stable kernel trees.
Affected products
- Linux Linux kernel Versions prior to fix (exact version range not specified in advisory)
Timeline
- 2026-09-11: disclosed: CVE published
- 2026-07-14: patched: Fix committed upstream (commit cf4500ebf6fb57bf4ab83c3dd349a40257dbe2a9)
- 2026-09-14: other: Fix backported to stable kernel trees