CVE-2026-89879 media: s2255: bound JPEG frame size before copying into the buffer
A malicious USB device can trigger a buffer overflow in the s2255 kernel driver, potentially leading to code execution or system crash.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-89879?
CVE-2026-89879 is a memory corruption vulnerability in Linux, published on 16 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
media: s2255: bound JPEG frame size before copying into the buffer
s2255_fillbuff() memcpy()s vc->jpg_size bytes of a captured JPEG/MJPEG frame into the vb2 plane. vc->jpg_size is taken verbatim from the S2255_MARKER_FRAME header the device sends (pdword[4] in save_frame()) and, unlike the frame payload length just above it, is never bounded:
payload = le32_to_cpu(pdword[3]); if (payload > vc->req_image_size) /* payload is checked ... */ return -EINVAL; vc->pkt_size = payload; vc->jpg_size = le32_to_cpu(pdword[4]); /* ... jpg_size is not */
A malicious or malfunctioning device can therefore report a jpg_size larger than the destination vb2 plane, and the memcpy() writes past it. jpg_size is a signed int, so a value with the top bit set also turns into a huge length.
Reject a frame whose jpg_size is negative or exceeds the plane size before copying it.
Which versions are affected by CVE-2026-89879?
How do I fix CVE-2026-89879?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-89879 being exploited?
There is no known exploitation of CVE-2026-89879 in the wild and no public exploit code.
Sources
Also known as AZL-101298, BELL-CVE-2026-89879, DEBIAN-CVE-2026-89879, GHSA-w8vh-2wxg-frpg, UBUNTU-CVE-2026-89879.