Not yet scoredPublished Sep 16, 2026

CVE-2026-89878media: s2255: check firmware size before reading trailing marker

Updated under an hour ago (Oct 27, 2026, 8:30 PM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: media: s2255: check firmware size before reading trailing marker s2255_probe() reads a 4-byte marker and version from the last 8 bytes of the firmware blob (fw->data[fw_size - 8] and [fw_size - 4]). If the firmware file is shorter than 8 bytes, fw_size - 8 underflows and the access reads out of bounds. Validate the firmware size before indexing.

CVSS: Not yet scored
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Received
Record last updated: Oct 19, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	14d962602c8bf86e63c9b9272be1f0360d0a448a builds before 6f6a5b0b0a84c2de0e152f2841e57bc226db924f; 14d962602c8bf86e63c9b9272be1f0360d0a448a builds before 8eca0f85eeb0789be40e637bcf9a21c4265b6c6f; from 14d962602c8bf86e63c9b9272be1f0360d0a448a before ffc27411ea60b8a09f1fea3d664b65210fdeb454; from 14d962602c8bf86e63c9b9272be1f0360d0a448a before 5626785b0e4665326e4d96736c106161da09b2f0; 14d962602c8bf86e63c9b9272be1f0360d0a448a builds before 3e03f1209c1c8a45a7bc559f4ecd79d9b33f706d; from 14d962602c8bf86e63c9b9272be1f0360d0a448a before 342632a4d8ba3fafc1556deee0b7a48dd7860336; 14d962602c8bf86e63c9b9272be1f0360d0a448a builds before 7d221859ba45d7228d0138c9a3e55bd3bb31e14e; from 14d962602c8bf86e63c9b9272be1f0360d0a448a before 330f2936ab768c7215322a476f033143e8891d28	CNA record

References

References

https://git.kernel.org/stable/c/6f6a5b0b0a84c2de0e152f2841e57bc226db924f
https://git.kernel.org/stable/c/8eca0f85eeb0789be40e637bcf9a21c4265b6c6f
https://git.kernel.org/stable/c/ffc27411ea60b8a09f1fea3d664b65210fdeb454
https://git.kernel.org/stable/c/5626785b0e4665326e4d96736c106161da09b2f0
https://git.kernel.org/stable/c/3e03f1209c1c8a45a7bc559f4ecd79d9b33f706d
https://git.kernel.org/stable/c/342632a4d8ba3fafc1556deee0b7a48dd7860336
https://git.kernel.org/stable/c/7d221859ba45d7228d0138c9a3e55bd3bb31e14e
https://git.kernel.org/stable/c/330f2936ab768c7215322a476f033143e8891d28

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.