Executive brief
The Linux kernel's cx231xx media driver (used for certain USB video capture devices) allows a local attacker to trigger a heap buffer overflow by changing video geometry settings while a VBI (vertical blanking interval) stream is active. An attacker with local access could exploit this to corrupt memory and potentially achieve code execution or cause a kernel crash.
Technical details
The vulnerability exists in the cx231xx media driver's handling of video geometry changes. The vidioc_s_fmt_vid_cap() and vidioc_std() functions modify device-wide geometry (width and norm/standard) but only check if the video queue is busy—not the VBI queue. Both queues share the same geometry configuration. An attacker can allocate a small VBI buffer, then enlarge the video geometry through the video node while the VBI stream runs; cx231xx_do_vbi_copy() subsequently computes offsets using the new, larger geometry and writes past the bounds of the smaller allocated buffer. The attack requires local access to the device node and the ability to open both video and VBI interfaces, but no elevated privileges or kernel-mode capability are required. A patch restricts format and standard changes when the VBI queue is also busy.
Affected products
- Linux Linux kernel affected versions not specified
Timeline
- 2026-09-16: disclosed
- 2026-09-16: advisory