GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-43256 (GCVE-0-2026-43256)

Vulnerability from cvelistv5 – Published: 2026-05-06 11:28 – Updated: 2026-08-05 12:26
VLAI
Title
media: qcom: camss: vfe: Fix out-of-bounds access in vfe_isr_reg_update()
Summary
In the Linux kernel, the following vulnerability has been resolved: media: qcom: camss: vfe: Fix out-of-bounds access in vfe_isr_reg_update() vfe_isr() iterates using MSM_VFE_IMAGE_MASTERS_NUM(7) as the loop bound and passes the index to vfe_isr_reg_update(). However, vfe->line[] array is defined with VFE_LINE_NUM_MAX(4): struct vfe_line line[VFE_LINE_NUM_MAX]; When index is 4, 5, 6, the access to vfe->line[line_id] exceeds the array bounds and resulting in out-of-bounds memory access. Fix this by using separate loops for output lines and write masters.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 4edc8eae715cecf5f8bf12a0c77c281f336c37db , < e6cbf765686fb6c1d8f2530b3daf6c66efc92f5d (git)
Affected: 4edc8eae715cecf5f8bf12a0c77c281f336c37db , < 0c074e80921fd18984b75836730d76c768c84f65 (git)
Affected: 4edc8eae715cecf5f8bf12a0c77c281f336c37db , < 1b103307df6d461a0731be25aca69ad0335b0933 (git)
Affected: 4edc8eae715cecf5f8bf12a0c77c281f336c37db , < fade67c88870f497a13ed450ba01f7236c92dd9b (git)
Affected: 4edc8eae715cecf5f8bf12a0c77c281f336c37db , < e7a38ecda2498e7ce998793ac2a46ca47317635d (git)
Affected: 4edc8eae715cecf5f8bf12a0c77c281f336c37db , < d965919af524e68cb2ab1a685872050ad2ee933d (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.18
Unaffected: 0 , < 5.18 (semver)
Unaffected: 6.1.167 , ≤ 6.1.* (semver)
Unaffected: 6.6.128 , ≤ 6.6.* (semver)
Unaffected: 6.12.75 , ≤ 6.12.* (semver)
Unaffected: 6.18.16 , ≤ 6.18.* (semver)
Unaffected: 6.19.6 , ≤ 6.19.* (semver)
Unaffected: 7.0 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/media/platform/qcom/camss/camss-vfe-480.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e6cbf765686fb6c1d8f2530b3daf6c66efc92f5d",
              "status": "affected",
              "version": "4edc8eae715cecf5f8bf12a0c77c281f336c37db",
              "versionType": "git"
            },
            {
              "lessThan": "0c074e80921fd18984b75836730d76c768c84f65",
              "status": "affected",
              "version": "4edc8eae715cecf5f8bf12a0c77c281f336c37db",
              "versionType": "git"
            },
            {
              "lessThan": "1b103307df6d461a0731be25aca69ad0335b0933",
              "status": "affected",
              "version": "4edc8eae715cecf5f8bf12a0c77c281f336c37db",
              "versionType": "git"
            },
            {
              "lessThan": "fade67c88870f497a13ed450ba01f7236c92dd9b",
              "status": "affected",
              "version": "4edc8eae715cecf5f8bf12a0c77c281f336c37db",
              "versionType": "git"
            },
            {
              "lessThan": "e7a38ecda2498e7ce998793ac2a46ca47317635d",
              "status": "affected",
              "version": "4edc8eae715cecf5f8bf12a0c77c281f336c37db",
              "versionType": "git"
            },
            {
              "lessThan": "d965919af524e68cb2ab1a685872050ad2ee933d",
              "status": "affected",
              "version": "4edc8eae715cecf5f8bf12a0c77c281f336c37db",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/media/platform/qcom/camss/camss-vfe-480.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.18"
            },
            {
              "lessThan": "5.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.167",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.128",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.75",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.16",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.167",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.128",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.75",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.16",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.6",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: qcom: camss: vfe: Fix out-of-bounds access in vfe_isr_reg_update()\n\nvfe_isr() iterates using MSM_VFE_IMAGE_MASTERS_NUM(7) as the loop\nbound and passes the index to vfe_isr_reg_update(). However,\nvfe-\u003eline[] array is defined with VFE_LINE_NUM_MAX(4):\n\n    struct vfe_line line[VFE_LINE_NUM_MAX];\n\nWhen index is 4, 5, 6, the access to vfe-\u003eline[line_id] exceeds\nthe array bounds and resulting in out-of-bounds memory access.\n\nFix this by using separate loops for output lines and write masters."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable path is reached through local V4L2/media device use, where a process starts CAMSS camera streaming and the hardware interrupt enters vfe_isr(). It is not directly network-facing and does not require physical hotplug beyond the affected built-in camera hardware.\nAC:L - On SM8250 VFE-lite, ordinary bus completion bits overlap the erroneous RDI_RUP checks for indices 4-6, so normal streaming interrupts can pass out-of-bounds line IDs. No race or condition outside the attacker\u0027s control is required once streaming is active.\nPR:L - The driver has no capable() or administrator-only check on this path; access is governed by V4L2 device-node or camera-service permissions. This is basic local privilege, not real root in the init namespace.\nUI:N - A malicious local process with access to the camera device can configure buffers and start streaming itself. No separate victim action is required.\nS:U - The impact remains within the kernel/CAMSS security authority. There is no guest-to-host, IOMMU, or other cross-scope boundary bypass.\nC:H - The bug performs out-of-bounds reads from kernel memory beyond vfe-\u003eline[]. Because this is repeatable kernel memory corruption, high confidentiality impact is defensible.\nI:H - If the out-of-bounds wait_reg_update field is nonzero, the ISR writes to out-of-bounds memory and calls complete() on an out-of-bounds completion object. This can corrupt adjacent kernel objects, so integrity impact is high.\nA:H - The out-of-bounds access and possible complete() on invalid memory occur in interrupt context and can cause an oops or panic. The trigger can be repeated by restarting or continuing camera streaming."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:26:55.873Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/e6cbf765686fb6c1d8f2530b3daf6c66efc92f5d"
        },
        {
          "url": "https://git.kernel.org/stable/c/0c074e80921fd18984b75836730d76c768c84f65"
        },
        {
          "url": "https://git.kernel.org/stable/c/1b103307df6d461a0731be25aca69ad0335b0933"
        },
        {
          "url": "https://git.kernel.org/stable/c/fade67c88870f497a13ed450ba01f7236c92dd9b"
        },
        {
          "url": "https://git.kernel.org/stable/c/e7a38ecda2498e7ce998793ac2a46ca47317635d"
        },
        {
          "url": "https://git.kernel.org/stable/c/d965919af524e68cb2ab1a685872050ad2ee933d"
        }
      ],
      "title": "media: qcom: camss: vfe: Fix out-of-bounds access in vfe_isr_reg_update()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-43256",
    "datePublished": "2026-05-06T11:28:45.209Z",
    "dateReserved": "2026-05-01T14:12:55.996Z",
    "dateUpdated": "2026-08-05T12:26:55.873Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-43256",
      "date": "2026-09-16",
      "epss": "0.00129",
      "percentile": "0.02947"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-43256\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-05-06T12:16:46.397\",\"lastModified\":\"2026-06-17T10:49:15.310\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmedia: qcom: camss: vfe: Fix out-of-bounds access in vfe_isr_reg_update()\\n\\nvfe_isr() iterates using MSM_VFE_IMAGE_MASTERS_NUM(7) as the loop\\nbound and passes the index to vfe_isr_reg_update(). However,\\nvfe-\u003eline[] array is defined with VFE_LINE_NUM_MAX(4):\\n\\n    struct vfe_line line[VFE_LINE_NUM_MAX];\\n\\nWhen index is 4, 5, 6, the access to vfe-\u003eline[line_id] exceeds\\nthe array bounds and resulting in out-of-bounds memory access.\\n\\nFix this by using separate loops for output lines and write masters.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/media/platform/qcom/camss/camss-vfe-480.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4edc8eae715cecf5f8bf12a0c77c281f336c37db\",\"lessThan\":\"e6cbf765686fb6c1d8f2530b3daf6c66efc92f5d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4edc8eae715cecf5f8bf12a0c77c281f336c37db\",\"lessThan\":\"0c074e80921fd18984b75836730d76c768c84f65\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4edc8eae715cecf5f8bf12a0c77c281f336c37db\",\"lessThan\":\"1b103307df6d461a0731be25aca69ad0335b0933\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4edc8eae715cecf5f8bf12a0c77c281f336c37db\",\"lessThan\":\"fade67c88870f497a13ed450ba01f7236c92dd9b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4edc8eae715cecf5f8bf12a0c77c281f336c37db\",\"lessThan\":\"e7a38ecda2498e7ce998793ac2a46ca47317635d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4edc8eae715cecf5f8bf12a0c77c281f336c37db\",\"lessThan\":\"d965919af524e68cb2ab1a685872050ad2ee933d\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/media/platform/qcom/camss/camss-vfe-480.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.18\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.18\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.167\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.128\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.75\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.16\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.19.6\",\"lessThanOrEqual\":\"6.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.0\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-125\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.18\",\"versionEndExcluding\":\"6.1.167\",\"matchCriteriaId\":\"25D24035-467E-4E84-987E-DA8067ECEAC4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.128\",\"matchCriteriaId\":\"851E9353-6C09-4CC9-877E-E09DB164A3C2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.75\",\"matchCriteriaId\":\"BCE16369-98ED-41CF-8995-DFDC10B288D2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.18.16\",\"matchCriteriaId\":\"B4B8CDA9-BADF-4CF5-8B3B-702DE8EEA40B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.19\",\"versionEndExcluding\":\"6.19.6\",\"matchCriteriaId\":\"373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0c074e80921fd18984b75836730d76c768c84f65\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/1b103307df6d461a0731be25aca69ad0335b0933\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d965919af524e68cb2ab1a685872050ad2ee933d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e6cbf765686fb6c1d8f2530b3daf6c66efc92f5d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e7a38ecda2498e7ce998793ac2a46ca47317635d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/fade67c88870f497a13ed450ba01f7236c92dd9b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-06-28T11:30:33+00:00",
      "cve": "CVE-2026-43256",
      "id": "CVE-2026-43256",
      "initial_release_date": "2026-05-06T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: media: qcom: camss: vfe: Fix out-of-bounds access in vfe_isr_reg_update()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43256.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-08-31T17:07:06Z",
      "cve": "CVE-2026-43256",
      "id": "CVE-2026-43256",
      "initial_release_date": "2026-05-09T02:40:10Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "424",
      "product_status:known_not_affected": "294",
      "product_status:recommended": "250",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-43256",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-43256.json",
      "version": "8"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.