Executive brief
The Linux kernel's s2255 media driver processes USB video capture device firmware during device initialization. When a malformed or truncated firmware file is loaded, the driver attempts to read validation data beyond the firmware's actual size, potentially exposing kernel memory or causing a crash. This could allow a local attacker with the ability to provide custom firmware to destabilize the system or leak sensitive data.
Technical details
This is a buffer over-read vulnerability in drivers/media/usb/s2255/s2255drv.c within the s2255_probe() function. The vulnerable code reads a firmware marker and version from the last 8 bytes of a firmware blob without validating that the firmware is at least 8 bytes in size. When fw_size is less than 8, the computation fw_size - 8 underflows (due to unsigned integer arithmetic), causing an out-of-bounds read from kernel memory. The attack requires local access to load a malformed firmware file, but no authentication or special privileges beyond kernel module loading are needed. An attacker can trigger a kernel panic or read sensitive kernel memory. The fix adds a simple size check before the indexing operation.
Affected products
- Linux Linux kernel all versions prior to patch commit 330f2936ab768c7215322a476f033143e8891d28
Timeline
- 2026-09-16: disclosed: CVE-2026-89878 published
- 2026-07-15: patched: Upstream patch merged by Hans Verkuil