GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-68219 (GCVE-0-2026-68219)

Vulnerability from cvelistv5 – Published: 2026-08-10 12:00 – Updated: 2026-08-17 05:01
VLAI
Title
media: nxp: imx8-isi: Fix potential out-of-bounds issues
Summary
In the Linux kernel, the following vulnerability has been resolved: media: nxp: imx8-isi: Fix potential out-of-bounds issues The maximum downscaling factor supported by ISI can be up to 16. Add minimum value constraint before applying the setting to hardware. Otherwise, the process will not respond even when Ctrl+C is executed.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: cf21f328fcafacf4f96e7a30ef9dceede1076378 , < 690cdda752f3dc6b7a8b2d4a243e0207b66a1f37 (git)
Affected: cf21f328fcafacf4f96e7a30ef9dceede1076378 , < ba7e1b06cbdad3b7c3314390cca22aff42f655d4 (git)
Affected: cf21f328fcafacf4f96e7a30ef9dceede1076378 , < 28ae75dba701d7aa69a36802c398582933d3e0e6 (git)
Affected: cf21f328fcafacf4f96e7a30ef9dceede1076378 , < 75cdfaa7c908ca06d564170da9c80fb579f149a5 (git)
Affected: cf21f328fcafacf4f96e7a30ef9dceede1076378 , < 57a7ec5c9f38ce6c4d6209c4b75c8e57e1fea6cf (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.4
Unaffected: 0 , < 6.4 (semver)
Unaffected: 6.6.148 , ≤ 6.6.* (semver)
Unaffected: 6.12.101 , ≤ 6.12.* (semver)
Unaffected: 6.18.42 , ≤ 6.18.* (semver)
Unaffected: 7.1.6 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/media/platform/nxp/imx8-isi/imx8-isi-core.h",
            "drivers/media/platform/nxp/imx8-isi/imx8-isi-m2m.c",
            "drivers/media/platform/nxp/imx8-isi/imx8-isi-pipe.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "690cdda752f3dc6b7a8b2d4a243e0207b66a1f37",
              "status": "affected",
              "version": "cf21f328fcafacf4f96e7a30ef9dceede1076378",
              "versionType": "git"
            },
            {
              "lessThan": "ba7e1b06cbdad3b7c3314390cca22aff42f655d4",
              "status": "affected",
              "version": "cf21f328fcafacf4f96e7a30ef9dceede1076378",
              "versionType": "git"
            },
            {
              "lessThan": "28ae75dba701d7aa69a36802c398582933d3e0e6",
              "status": "affected",
              "version": "cf21f328fcafacf4f96e7a30ef9dceede1076378",
              "versionType": "git"
            },
            {
              "lessThan": "75cdfaa7c908ca06d564170da9c80fb579f149a5",
              "status": "affected",
              "version": "cf21f328fcafacf4f96e7a30ef9dceede1076378",
              "versionType": "git"
            },
            {
              "lessThan": "57a7ec5c9f38ce6c4d6209c4b75c8e57e1fea6cf",
              "status": "affected",
              "version": "cf21f328fcafacf4f96e7a30ef9dceede1076378",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/media/platform/nxp/imx8-isi/imx8-isi-core.h",
            "drivers/media/platform/nxp/imx8-isi/imx8-isi-m2m.c",
            "drivers/media/platform/nxp/imx8-isi/imx8-isi-pipe.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.4"
            },
            {
              "lessThan": "6.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.148",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.101",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.148",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.101",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.42",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.6",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: nxp: imx8-isi: Fix potential out-of-bounds issues\n\nThe maximum downscaling factor supported by ISI can be up to 16. Add\nminimum value constraint before applying the setting to hardware.\nOtherwise, the process will not respond even when Ctrl+C is executed."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is reached exclusively through V4L2 ioctls (VIDIOC_S_FMT on the /dev/videoX M2M node, or VIDIOC_SUBDEV_S_SELECTION on the ISI pipe subdev), which require local access to the device node. There is no remote or adjacent-network path into the imx8-isi driver.\nAC:L - Exploitation is a deterministic ioctl sequence: set a large OUTPUT format, set a 1x1 CAPTURE format (accepted because the bound was only min() against the source size and MXC_ISI_MIN_WIDTH/HEIGHT = 1), queue buffers and stream. No race, timing window, or uncontrollable memory-layout condition is involved.\nPR:L - The attacker only needs to open the ISI video device node; no capability check exists anywhere along the path from the ioctl handler to mxc_isi_channel_set_scaling(). On the i.MX8 embedded, automotive and vision devices where this driver runs, /dev/video* is routinely accessible to ordinary unprivileged applications via the video/camera group.\nUI:N - The attacking process performs the entire sequence itself \u2014 open, S_FMT, REQBUFS, QBUF, STREAMON \u2014 with no victim action, no separate privileged process, and no administrator step required.\nS:U - The corruption and the hang stay within the kernel of the same machine; the ISI DMA write targets kernel memory adjacent to the video buffer and does not cross a VM, hypervisor or IOMMU security boundary.\nC:H - The scaler saturates at a 16x factor while the destination buffer and CHNL_OUT_BUF_PITCH are sized from the far smaller requested format, so the ISI DMA engine overruns the video buffer into adjacent kernel memory; such heap corruption in DMA-able memory is leverageable to disclose kernel memory contents, and stale buffer content is returned to userspace.\nI:H - The hardware writes an image much larger than the allocated destination buffer, producing an out-of-bounds DMA write whose contents are the attacker\u0027s own input frame in M2M mode \u2014 an attacker-controlled overwrite of kernel memory following the buffer, sufficient for control-flow-relevant corruption.\nA:H - The fix commit states the transaction never completes and \"the process will not respond even when Ctrl+C is executed\", leaving an unkillable task and a wedged ISI channel that denies the imaging pipeline to all users; the accompanying out-of-bounds DMA write can additionally panic the kernel."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:01:05.813Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/690cdda752f3dc6b7a8b2d4a243e0207b66a1f37"
        },
        {
          "url": "https://git.kernel.org/stable/c/ba7e1b06cbdad3b7c3314390cca22aff42f655d4"
        },
        {
          "url": "https://git.kernel.org/stable/c/28ae75dba701d7aa69a36802c398582933d3e0e6"
        },
        {
          "url": "https://git.kernel.org/stable/c/75cdfaa7c908ca06d564170da9c80fb579f149a5"
        },
        {
          "url": "https://git.kernel.org/stable/c/57a7ec5c9f38ce6c4d6209c4b75c8e57e1fea6cf"
        }
      ],
      "title": "media: nxp: imx8-isi: Fix potential out-of-bounds issues",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-68219",
    "datePublished": "2026-08-10T12:00:39.405Z",
    "dateReserved": "2026-07-30T09:28:09.375Z",
    "dateUpdated": "2026-08-17T05:01:05.813Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-68219",
      "date": "2026-09-11",
      "epss": "0.00175",
      "percentile": "0.07167"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-68219\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-10T13:20:09.897\",\"lastModified\":\"2026-08-17T05:18:24.080\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmedia: nxp: imx8-isi: Fix potential out-of-bounds issues\\n\\nThe maximum downscaling factor supported by ISI can be up to 16. Add\\nminimum value constraint before applying the setting to hardware.\\nOtherwise, the process will not respond even when Ctrl+C is executed.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/media/platform/nxp/imx8-isi/imx8-isi-core.h\",\"drivers/media/platform/nxp/imx8-isi/imx8-isi-m2m.c\",\"drivers/media/platform/nxp/imx8-isi/imx8-isi-pipe.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"cf21f328fcafacf4f96e7a30ef9dceede1076378\",\"lessThan\":\"690cdda752f3dc6b7a8b2d4a243e0207b66a1f37\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"cf21f328fcafacf4f96e7a30ef9dceede1076378\",\"lessThan\":\"ba7e1b06cbdad3b7c3314390cca22aff42f655d4\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"cf21f328fcafacf4f96e7a30ef9dceede1076378\",\"lessThan\":\"28ae75dba701d7aa69a36802c398582933d3e0e6\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"cf21f328fcafacf4f96e7a30ef9dceede1076378\",\"lessThan\":\"75cdfaa7c908ca06d564170da9c80fb579f149a5\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"cf21f328fcafacf4f96e7a30ef9dceede1076378\",\"lessThan\":\"57a7ec5c9f38ce6c4d6209c4b75c8e57e1fea6cf\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/media/platform/nxp/imx8-isi/imx8-isi-core.h\",\"drivers/media/platform/nxp/imx8-isi/imx8-isi-m2m.c\",\"drivers/media/platform/nxp/imx8-isi/imx8-isi-pipe.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.4\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.4\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.148\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.101\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.42\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.6\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/28ae75dba701d7aa69a36802c398582933d3e0e6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/57a7ec5c9f38ce6c4d6209c4b75c8e57e1fea6cf\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/690cdda752f3dc6b7a8b2d4a243e0207b66a1f37\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/75cdfaa7c908ca06d564170da9c80fb579f149a5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/ba7e1b06cbdad3b7c3314390cca22aff42f655d4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-31T11:19:01+00:00",
      "cve": "CVE-2026-68219",
      "id": "CVE-2026-68219",
      "initial_release_date": "2026-08-10T00:00:00+00:00",
      "product_status:known_not_affected": "277",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: media: nxp: imx8-isi: Fix potential out-of-bounds issues",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68219.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-18T16:55:59Z",
      "cve": "CVE-2026-68219",
      "id": "CVE-2026-68219",
      "initial_release_date": "2026-08-18T16:55:59Z",
      "product_status:known_affected": "30",
      "product_status:known_not_affected": "266",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-68219",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-68219.json",
      "version": "2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.