Executive brief
The Linux kernel's media driver for Sensoray S2255 video capture devices contains a buffer overflow vulnerability in JPEG frame processing. A malicious or malfunctioning device can report an oversized JPEG frame size, causing the kernel to copy data beyond the allocated buffer boundary, potentially leading to kernel memory corruption and system instability.
Technical details
The vulnerability is a classic buffer overflow in the s2255_fillbuff() function within the s2255 USB media driver. The function copies JPEG frame data into a vb2 (video for linux 2) plane buffer using memcpy(), but fails to validate the frame size (vc->jpg_size) reported by the device before copying. The jpg_size value is extracted directly from the S2255_MARKER_FRAME header (pdword[4]) without bounds checking, unlike the payload length (pdword[3]) which is validated. Since jpg_size is a signed integer, malicious values with the top bit set result in huge unsigned lengths. Attack vector is network-adjacent (requires a malicious/modified USB device); no authentication or user interaction is needed. The patch adds a bounds check to reject frames where jpg_size is negative or exceeds the vb2 plane allocation before the memcpy() executes.
Affected products
- Linux Linux kernel all versions with s2255 driver (since kernel 2.6.26)
Timeline
- 2026-09-16: disclosed: CVE published on NVD
- 2026-07-01: patched: Fix committed upstream (commit e504cc888f42999dd76b6a43788c422610f2aad2)