CVE-2026-89879

In the Linux kernel, the following vulnerability has been resolved:

media: s2255: bound JPEG frame size before copying into the buffer

s2255_fillbuff() memcpy()s vc->jpg_size bytes of a captured JPEG/MJPEG

frame into the vb2 plane. vc->jpg_size is taken verbatim from the

S2255_MARKER_FRAME header the device sends (pdword[4] in save_frame())

and, unlike the frame payload length just above it, is never bounded:

payload = le32_to_cpu(pdword[3]);

if (payload > vc->req_image_size) /* payload is checked ... */

return -EINVAL;

vc->pkt_size = payload;

vc->jpg_size = le32_to_cpu(pdword[4]); /* ... jpg_size is not */

A malicious or malfunctioning device can therefore report a jpg_size

larger than the destination vb2 plane, and the memcpy() writes past it.

jpg_size is a signed int, so a value with the top bit set also turns

into a huge length.

Reject a frame whose jpg_size is negative or exceeds the plane size

before copying it.