{"id":"CVE-2026-68219","state":"PUBLISHED","title":"media: nxp: imx8-isi: Fix potential out-of-bounds issues","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: nxp: imx8-isi: Fix potential out-of-bounds issues\n\nThe maximum downscaling factor supported by ISI can be up to 16. Add\nminimum value constraint before applying the setting to hardware.\nOtherwise, the process will not respond even when Ctrl+C is executed.","publishedAt":"2026-08-10T12:00:39.405Z","updatedAt":"2026-08-17T05:01:05.813Z","severity":{"score":7.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"cf21f328fcafacf4f96e7a30ef9dceede1076378","status":"affected","lessThan":"690cdda752f3dc6b7a8b2d4a243e0207b66a1f37","versionType":"git"},{"version":"cf21f328fcafacf4f96e7a30ef9dceede1076378","status":"affected","lessThan":"ba7e1b06cbdad3b7c3314390cca22aff42f655d4","versionType":"git"},{"version":"cf21f328fcafacf4f96e7a30ef9dceede1076378","status":"affected","lessThan":"28ae75dba701d7aa69a36802c398582933d3e0e6","versionType":"git"},{"version":"cf21f328fcafacf4f96e7a30ef9dceede1076378","status":"affected","lessThan":"75cdfaa7c908ca06d564170da9c80fb579f149a5","versionType":"git"},{"version":"cf21f328fcafacf4f96e7a30ef9dceede1076378","status":"affected","lessThan":"57a7ec5c9f38ce6c4d6209c4b75c8e57e1fea6cf","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/media/platform/nxp/imx8-isi/imx8-isi-core.h","drivers/media/platform/nxp/imx8-isi/imx8-isi-m2m.c","drivers/media/platform/nxp/imx8-isi/imx8-isi-pipe.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.4","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.4","versionType":"semver"},{"version":"6.6.148","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.101","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.42","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.1.6","status":"unaffected","lessThanOrEqual":"7.1.*","versionType":"semver"},{"version":"7.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/media/platform/nxp/imx8-isi/imx8-isi-core.h","drivers/media/platform/nxp/imx8-isi/imx8-isi-m2m.c","drivers/media/platform/nxp/imx8-isi/imx8-isi-pipe.c"]}],"references":["https://git.kernel.org/stable/c/690cdda752f3dc6b7a8b2d4a243e0207b66a1f37","https://git.kernel.org/stable/c/ba7e1b06cbdad3b7c3314390cca22aff42f655d4","https://git.kernel.org/stable/c/28ae75dba701d7aa69a36802c398582933d3e0e6","https://git.kernel.org/stable/c/75cdfaa7c908ca06d564170da9c80fb579f149a5","https://git.kernel.org/stable/c/57a7ec5c9f38ce6c4d6209c4b75c8e57e1fea6cf"],"weaknesses":[],"ingestedAt":"2026-10-29T20:12:49.727Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/68xxx/CVE-2026-68219.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-68219","state":"PUBLISHED","datePublished":"2026-08-10T12:00:39.405Z","dateUpdated":"2026-08-17T05:01:05.813Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-07-30T09:28:09.375Z"},"containers":{"cna":{"title":"media: nxp: imx8-isi: Fix potential out-of-bounds issues","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: nxp: imx8-isi: Fix potential out-of-bounds issues\n\nThe maximum downscaling factor supported by ISI can be up to 16. Add\nminimum value constraint before applying the setting to hardware.\nOtherwise, the process will not respond even when Ctrl+C is executed."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"cf21f328fcafacf4f96e7a30ef9dceede1076378","status":"affected","lessThan":"690cdda752f3dc6b7a8b2d4a243e0207b66a1f37","versionType":"git"},{"version":"cf21f328fcafacf4f96e7a30ef9dceede1076378","status":"affected","lessThan":"ba7e1b06cbdad3b7c3314390cca22aff42f655d4","versionType":"git"},{"version":"cf21f328fcafacf4f96e7a30ef9dceede1076378","status":"affected","lessThan":"28ae75dba701d7aa69a36802c398582933d3e0e6","versionType":"git"},{"version":"cf21f328fcafacf4f96e7a30ef9dceede1076378","status":"affected","lessThan":"75cdfaa7c908ca06d564170da9c80fb579f149a5","versionType":"git"},{"version":"cf21f328fcafacf4f96e7a30ef9dceede1076378","status":"affected","lessThan":"57a7ec5c9f38ce6c4d6209c4b75c8e57e1fea6cf","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/media/platform/nxp/imx8-isi/imx8-isi-core.h","drivers/media/platform/nxp/imx8-isi/imx8-isi-m2m.c","drivers/media/platform/nxp/imx8-isi/imx8-isi-pipe.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.4","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.4","versionType":"semver"},{"version":"6.6.148","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.101","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.42","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.1.6","status":"unaffected","lessThanOrEqual":"7.1.*","versionType":"semver"},{"version":"7.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/media/platform/nxp/imx8-isi/imx8-isi-core.h","drivers/media/platform/nxp/imx8-isi/imx8-isi-m2m.c","drivers/media/platform/nxp/imx8-isi/imx8-isi-pipe.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/690cdda752f3dc6b7a8b2d4a243e0207b66a1f37"},{"url":"https://git.kernel.org/stable/c/ba7e1b06cbdad3b7c3314390cca22aff42f655d4"},{"url":"https://git.kernel.org/stable/c/28ae75dba701d7aa69a36802c398582933d3e0e6"},{"url":"https://git.kernel.org/stable/c/75cdfaa7c908ca06d564170da9c80fb579f149a5"},{"url":"https://git.kernel.org/stable/c/57a7ec5c9f38ce6c4d6209c4b75c8e57e1fea6cf"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerability is reached exclusively through V4L2 ioctls (VIDIOC_S_FMT on the /dev/videoX M2M node, or VIDIOC_SUBDEV_S_SELECTION on the ISI pipe subdev), which require local access to the device node. There is no remote or adjacent-network path into the imx8-isi driver.\nAC:L - Exploitation is a deterministic ioctl sequence: set a large OUTPUT format, set a 1x1 CAPTURE format (accepted because the bound was only min() against the source size and MXC_ISI_MIN_WIDTH/HEIGHT = 1), queue buffers and stream. No race, timing window, or uncontrollable memory-layout condition is involved.\nPR:L - The attacker only needs to open the ISI video device node; no capability check exists anywhere along the path from the ioctl handler to mxc_isi_channel_set_scaling(). On the i.MX8 embedded, automotive and vision devices where this driver runs, /dev/video* is routinely accessible to ordinary unprivileged applications via the video/camera group.\nUI:N - The attacking process performs the entire sequence itself — open, S_FMT, REQBUFS, QBUF, STREAMON — with no victim action, no separate privileged process, and no administrator step required.\nS:U - The corruption and the hang stay within the kernel of the same machine; the ISI DMA write targets kernel memory adjacent to the video buffer and does not cross a VM, hypervisor or IOMMU security boundary.\nC:H - The scaler saturates at a 16x factor while the destination buffer and CHNL_OUT_BUF_PITCH are sized from the far smaller requested format, so the ISI DMA engine overruns the video buffer into adjacent kernel memory; such heap corruption in DMA-able memory is leverageable to disclose kernel memory contents, and stale buffer content is returned to userspace.\nI:H - The hardware writes an image much larger than the allocated destination buffer, producing an out-of-bounds DMA write whose contents are the attacker's own input frame in M2M mode — an attacker-controlled overwrite of kernel memory following the buffer, sufficient for control-flow-relevant corruption.\nA:H - The fix commit states the transaction never completes and \"the process will not respond even when Ctrl+C is executed\", leaving an unkillable task and a wedged ISI channel that denies the imaging pipeline to all users; the accompanying out-of-bounds DMA write can additionally panic the kernel."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-17T05:01:05.813Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.4","versionEndExcluding":"6.6.148"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.4","versionEndExcluding":"6.12.101"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.4","versionEndExcluding":"6.18.42"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.4","versionEndExcluding":"7.1.6"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.4","versionEndExcluding":"7.2"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}}}}}