CVE-2026-43256

media: qcom: camss: vfe: Fix out-of-bounds access in vfe_isr_reg_update()

High · published May 6, 2026

CVSS v3.1
7.8
EPSS
0%
Percentile
6.7
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

media: qcom: camss: vfe: Fix out-of-bounds access in vfe_isr_reg_update()

vfe_isr() iterates using MSM_VFE_IMAGE_MASTERS_NUM(7) as the loop

bound and passes the index to vfe_isr_reg_update(). However,

vfe->line[] array is defined with VFE_LINE_NUM_MAX(4):

struct vfe_line line[VFE_LINE_NUM_MAX];

When index is 4, 5, 6, the access to vfe->line[line_id] exceeds

the array bounds and resulting in out-of-bounds memory access.

Fix this by using separate loops for output lines and write masters.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00176 · 6.7th percentile
Published
2026-05-06T11:28Z
EPSS history
Timeline
  • 06 MAY 11:28Z
    media: qcom: camss: vfe: Fix out-of-bounds access in vfe_isr_reg_update()
    cvelistv5