Vulnerability-Lookup

GHSA-6P56-XJ79-W693

Vulnerability from github – Published: 2026-08-10 15:33 – Updated: 2026-08-14 00:31

Details

In the Linux kernel, the following vulnerability has been resolved:

media: nxp: imx8-isi: Fix potential out-of-bounds issues

The maximum downscaling factor supported by ISI can be up to 16. Add minimum value constraint before applying the setting to hardware. Otherwise, the process will not respond even when Ctrl+C is executed.

Severity

7.8 (High)


                  
                    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-68219"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-10T13:20:09Z",
    "severity": "HIGH"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: nxp: imx8-isi: Fix potential out-of-bounds issues\n\nThe maximum downscaling factor supported by ISI can be up to 16. Add\nminimum value constraint before applying the setting to hardware.\nOtherwise, the process will not respond even when Ctrl+C is executed.",
  "id": "GHSA-6p56-xj79-w693",
  "modified": "2026-08-14T00:31:53Z",
  "published": "2026-08-10T15:33:41Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-68219"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/28ae75dba701d7aa69a36802c398582933d3e0e6"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/57a7ec5c9f38ce6c4d6209c4b75c8e57e1fea6cf"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/690cdda752f3dc6b7a8b2d4a243e0207b66a1f37"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/75cdfaa7c908ca06d564170da9c80fb579f149a5"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/ba7e1b06cbdad3b7c3314390cca22aff42f655d4"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2026-68219 (GCVE-0-2026-68219)

Vulnerability from cvelistv5 – Published: 2026-08-10 12:00 – Updated: 2026-08-17 05:01

Title

media: nxp: imx8-isi: Fix potential out-of-bounds issues

Summary

In the Linux kernel, the following vulnerability has been resolved: media: nxp: imx8-isi: Fix potential out-of-bounds issues The maximum downscaling factor supported by ISI can be up to 16. Add minimum value constraint before applying the setting to hardware. Otherwise, the process will not respond even when Ctrl+C is executed.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux mitre root

References

5 references

URL	Tags
https://git.kernel.org/stable/c/690cdda752f3dc6b7…
https://git.kernel.org/stable/c/ba7e1b06cbdad3b7c…
https://git.kernel.org/stable/c/28ae75dba701d7aa6…
https://git.kernel.org/stable/c/75cdfaa7c908ca06d…
https://git.kernel.org/stable/c/57a7ec5c9f38ce6c4…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: cf21f328fcafacf4f96e7a30ef9dceede1076378 , < 690cdda752f3dc6b7a8b2d4a243e0207b66a1f37 (git) Affected: cf21f328fcafacf4f96e7a30ef9dceede1076378 , < ba7e1b06cbdad3b7c3314390cca22aff42f655d4 (git) Affected: cf21f328fcafacf4f96e7a30ef9dceede1076378 , < 28ae75dba701d7aa69a36802c398582933d3e0e6 (git) Affected: cf21f328fcafacf4f96e7a30ef9dceede1076378 , < 75cdfaa7c908ca06d564170da9c80fb579f149a5 (git) Affected: cf21f328fcafacf4f96e7a30ef9dceede1076378 , < 57a7ec5c9f38ce6c4d6209c4b75c8e57e1fea6cf (git)
Linux	Linux	Affected: 6.4 Unaffected: 0 , < 6.4 (semver) Unaffected: 6.6.148 , ≤ 6.6.* (semver) Unaffected: 6.12.101 , ≤ 6.12.* (semver) Unaffected: 6.18.42 , ≤ 6.18.* (semver) Unaffected: 7.1.6 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/media/platform/nxp/imx8-isi/imx8-isi-core.h",
            "drivers/media/platform/nxp/imx8-isi/imx8-isi-m2m.c",
            "drivers/media/platform/nxp/imx8-isi/imx8-isi-pipe.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "690cdda752f3dc6b7a8b2d4a243e0207b66a1f37",
              "status": "affected",
              "version": "cf21f328fcafacf4f96e7a30ef9dceede1076378",
              "versionType": "git"
            },
            {
              "lessThan": "ba7e1b06cbdad3b7c3314390cca22aff42f655d4",
              "status": "affected",
              "version": "cf21f328fcafacf4f96e7a30ef9dceede1076378",
              "versionType": "git"
            },
            {
              "lessThan": "28ae75dba701d7aa69a36802c398582933d3e0e6",
              "status": "affected",
              "version": "cf21f328fcafacf4f96e7a30ef9dceede1076378",
              "versionType": "git"
            },
            {
              "lessThan": "75cdfaa7c908ca06d564170da9c80fb579f149a5",
              "status": "affected",
              "version": "cf21f328fcafacf4f96e7a30ef9dceede1076378",
              "versionType": "git"
            },
            {
              "lessThan": "57a7ec5c9f38ce6c4d6209c4b75c8e57e1fea6cf",
              "status": "affected",
              "version": "cf21f328fcafacf4f96e7a30ef9dceede1076378",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/media/platform/nxp/imx8-isi/imx8-isi-core.h",
            "drivers/media/platform/nxp/imx8-isi/imx8-isi-m2m.c",
            "drivers/media/platform/nxp/imx8-isi/imx8-isi-pipe.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.4"
            },
            {
              "lessThan": "6.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.148",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.101",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.148",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.101",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.42",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.6",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: nxp: imx8-isi: Fix potential out-of-bounds issues\n\nThe maximum downscaling factor supported by ISI can be up to 16. Add\nminimum value constraint before applying the setting to hardware.\nOtherwise, the process will not respond even when Ctrl+C is executed."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is reached exclusively through V4L2 ioctls (VIDIOC_S_FMT on the /dev/videoX M2M node, or VIDIOC_SUBDEV_S_SELECTION on the ISI pipe subdev), which require local access to the device node. There is no remote or adjacent-network path into the imx8-isi driver.\nAC:L - Exploitation is a deterministic ioctl sequence: set a large OUTPUT format, set a 1x1 CAPTURE format (accepted because the bound was only min() against the source size and MXC_ISI_MIN_WIDTH/HEIGHT = 1), queue buffers and stream. No race, timing window, or uncontrollable memory-layout condition is involved.\nPR:L - The attacker only needs to open the ISI video device node; no capability check exists anywhere along the path from the ioctl handler to mxc_isi_channel_set_scaling(). On the i.MX8 embedded, automotive and vision devices where this driver runs, /dev/video* is routinely accessible to ordinary unprivileged applications via the video/camera group.\nUI:N - The attacking process performs the entire sequence itself \u2014 open, S_FMT, REQBUFS, QBUF, STREAMON \u2014 with no victim action, no separate privileged process, and no administrator step required.\nS:U - The corruption and the hang stay within the kernel of the same machine; the ISI DMA write targets kernel memory adjacent to the video buffer and does not cross a VM, hypervisor or IOMMU security boundary.\nC:H - The scaler saturates at a 16x factor while the destination buffer and CHNL_OUT_BUF_PITCH are sized from the far smaller requested format, so the ISI DMA engine overruns the video buffer into adjacent kernel memory; such heap corruption in DMA-able memory is leverageable to disclose kernel memory contents, and stale buffer content is returned to userspace.\nI:H - The hardware writes an image much larger than the allocated destination buffer, producing an out-of-bounds DMA write whose contents are the attacker\u0027s own input frame in M2M mode \u2014 an attacker-controlled overwrite of kernel memory following the buffer, sufficient for control-flow-relevant corruption.\nA:H - The fix commit states the transaction never completes and \"the process will not respond even when Ctrl+C is executed\", leaving an unkillable task and a wedged ISI channel that denies the imaging pipeline to all users; the accompanying out-of-bounds DMA write can additionally panic the kernel."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:01:05.813Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/690cdda752f3dc6b7a8b2d4a243e0207b66a1f37"
        },
        {
          "url": "https://git.kernel.org/stable/c/ba7e1b06cbdad3b7c3314390cca22aff42f655d4"
        },
        {
          "url": "https://git.kernel.org/stable/c/28ae75dba701d7aa69a36802c398582933d3e0e6"
        },
        {
          "url": "https://git.kernel.org/stable/c/75cdfaa7c908ca06d564170da9c80fb579f149a5"
        },
        {
          "url": "https://git.kernel.org/stable/c/57a7ec5c9f38ce6c4d6209c4b75c8e57e1fea6cf"
        }
      ],
      "title": "media: nxp: imx8-isi: Fix potential out-of-bounds issues",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-68219",
    "datePublished": "2026-08-10T12:00:39.405Z",
    "dateReserved": "2026-07-30T09:28:09.375Z",
    "dateUpdated": "2026-08-17T05:01:05.813Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

GHSA-6P56-XJ79-W693

CVE-2026-68219 (GCVE-0-2026-68219)

Tags

Sightings

Nomenclature