Skip to main content

Linux Kernel EUVDEUVD-2026-55331

| CVE-2026-68230 HIGH
2026-08-10 Linux GHSA-mgwm-9whm-8cxc
Buffer Overflow Linux Suse
7.3
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
7.3 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H
vuln.today AI
7.3 HIGH

Local low-privilege access required to reach the ISP driver interface; overread exposes kernel memory (C:H) and overflow can cause kernel panic (A:H) with limited integrity impact.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
Low
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 14, 2026 - 03:29 vuln.today
CVSS changed
Aug 13, 2026 - 23:37 NVD
7.3 (HIGH)
Patch available
Aug 10, 2026 - 14:18 EUVD
CVE Published
Aug 10, 2026 - 12:00 cve.org
HIGH 7.3
CVE Published
Aug 10, 2026 - 12:00 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

media: amlogic-c3: Add validations for ae and awb config

Avoid invalid memory access if the zones_num is bigger than zone_weight.

This patch fixes the following smatch errors: drivers/media/platform/amlogic/c3/isp/c3-isp-params.c:111 c3_isp_params_awb_wt() error: buffer overflow 'cfg->zone_weight' 768 <= u32max drivers/media/platform/amlogic/c3/isp/c3-isp-params.c:111 c3_isp_params_awb_wt() error: buffer overflow 'cfg->zone_weight' 768 <= u32max drivers/media/platform/amlogic/c3/isp/c3-isp-params.c:227 c3_isp_params_ae_wt() error: buffer overflow 'cfg->zone_weight' 255 <= u32max drivers/media/platform/amlogic/c3/isp/c3-isp-params.c:227 c3_isp_params_ae_wt() error: buffer overflow 'cfg->zone_weight' 255 <= u32max

AnalysisAI

Buffer overflow in the Linux kernel's Amlogic C3 ISP driver allows a local low-privileged attacker to trigger out-of-bounds memory access via crafted camera parameter configurations, with potential for kernel memory disclosure and system crash. Affected functions c3_isp_params_awb_wt() and c3_isp_params_ae_wt() in drivers/media/platform/amlogic/c3/isp/c3-isp-params.c fail to validate zones_num against the fixed-size zone_weight array bounds (768 entries for AWB, 255 for AE). Patched upstream in kernel versions 6.18.42, 7.1.6, and 7.2-rc1; EPSS is 0.21% with no public exploit or CISA KEV listing, indicating low active exploitation pressure.

Technical ContextAI

The Amlogic C3 is a media-focused SoC used in embedded Linux camera and video processing platforms. The Linux kernel ships a dedicated ISP (Image Signal Processor) driver for this chip under drivers/media/platform/amlogic/c3/isp/. The vulnerability resides in two parameter-handling functions: c3_isp_params_awb_wt() at line 111 and c3_isp_params_ae_wt() at line 227 of c3-isp-params.c. Both functions iterate over zones using zones_num as the loop bound, writing into the fixed-size cfg->zone_weight array without first validating that zones_num does not exceed the array capacity (768 slots for AWB, 255 for AE). When user-controlled or malformed input provides an oversized zones_num, writes proceed past the end of the array into adjacent kernel memory - a classic bounds-unchecked array write. The root cause is effectively CWE-120 (Buffer Copy without Checking Size of Input), though NVD has not yet assigned a CWE. The CPE cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* covers the affected kernel. The bug was identified via smatch static analysis, which flagged that zones_num can theoretically be as large as u32max against a 768- or 255-element array.

RemediationAI

The primary remediation is to upgrade to a patched Linux kernel version: 6.18.42 or 7.1.6 for stable series users, or 7.2-rc1 and later for mainline. The upstream fix commits are published at https://git.kernel.org/stable/c/391fe3e36e59f3c6e3d46edfb3a5de51e00cd216, https://git.kernel.org/stable/c/32cbe5474e74817aa8a576b94135cc45e59f5e07, and https://git.kernel.org/stable/c/9724164f71974a2a44a5e026614fbcc05bab6d91. For systems that cannot immediately patch, a viable workaround is to blacklist the c3-isp kernel module by adding 'blacklist c3-isp' to /etc/modprobe.d/blacklist.conf and rebooting - this prevents the driver from loading and eliminates the vulnerable code path entirely. The trade-off is loss of Amlogic C3 ISP camera and image processing functionality. Systems that do not have Amlogic C3 hardware present require no action as the driver will not load. Operators running this driver in production should assess urgency against kernel upgrade cadence and the limited exploitation feasibility given the local-access requirement.

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0 Not-Affected

Share

EUVD-2026-55331 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy