{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  media: s2255: bound JPEG frame size before copying into the buffer  s2255_fillbuff() memcpy()s vc-\u003ejpg_size bytes of a captured JPEG/MJPEG frame into the vb2 plane.  vc-\u003ejpg_size is taken verbatim from the S2255_MARKER_FRAME header the device sends (pdword[4] in save_frame()) and, unlike the frame payload length just above it, is never bounded:  \tpayload = le32_to_cpu(pdword[3]); \tif (payload \u003e vc-\u003ereq_image_size)\t/* payload is checked ... */ \t\treturn -EINVAL; \tvc-\u003epkt_size = payload; \tvc-\u003ejpg_size = le32_to_cpu(pdword[4]);\t/* ... jpg_size is not */  A malicious or malfunctioning device can therefore report a jpg_size larger than the destination vb2 plane, and the memcpy() writes past it. jpg_size is a signed int, so a value with the top bit set also turns into a huge length.  Reject a frame whose jpg_size is negative or exceeds the plane size before copying it.",
  "id": "DEBIAN-CVE-2026-89879",
  "modified": "2026-09-17T04:47:38.390305804Z",
  "published": "2026-09-16T11:16:56.230Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-89879"
    }
  ],
  "upstream": [
    "CVE-2026-89879"
  ]
}