CVE-2026-89878 media: s2255: check firmware size before reading trailing marker
An integer underflow in the s2255 media driver allows out-of-bounds reads if firmware is too small, potentially causing crashes or data leaks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-89878?
CVE-2026-89878 is a vulnerability in Linux, published on 16 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
media: s2255: check firmware size before reading trailing marker
s2255_probe() reads a 4-byte marker and version from the last 8 bytes of the firmware blob (fw->data[fw_size - 8] and [fw_size - 4]). If the firmware file is shorter than 8 bytes, fw_size - 8 underflows and the access reads out of bounds. Validate the firmware size before indexing.
Which versions are affected by CVE-2026-89878?
How do I fix CVE-2026-89878?
Apply the vendor's patch.
Is CVE-2026-89878 being exploited?
There is no known exploitation of CVE-2026-89878 in the wild and no public exploit code.
Sources
Also known as AZL-101256, BELL-CVE-2026-89878, DEBIAN-CVE-2026-89878, GHSA-8258-qf7j-hr2g, UBUNTU-CVE-2026-89878.