In the Linux kernel, the following vulnerability has been resolved:
media: qcom: camss: vfe: Fix out-of-bounds access in vfe_isr_reg_update()
vfe_isr() iterates using MSM_VFE_IMAGE_MASTERS_NUM(7) as the loop
bound and passes the index to vfe_isr_reg_update(). However,
vfe->line[] array is defined with VFE_LINE_NUM_MAX(4):
struct vfe_line line[VFE_LINE_NUM_MAX];
When index is 4, 5, 6, the access to vfe->line[line_id] exceeds
the array bounds and resulting in out-of-bounds memory access.
Fix this by using separate loops for output lines and write masters.
References
Configurations
Configuration 1 (hide)
|
History
11 May 2026, 18:16
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | |
| CWE | CWE-125 | |
| First Time |
Linux linux Kernel
Linux |
|
| References | () https://git.kernel.org/stable/c/0c074e80921fd18984b75836730d76c768c84f65 - Patch | |
| References | () https://git.kernel.org/stable/c/1b103307df6d461a0731be25aca69ad0335b0933 - Patch | |
| References | () https://git.kernel.org/stable/c/d965919af524e68cb2ab1a685872050ad2ee933d - Patch | |
| References | () https://git.kernel.org/stable/c/e6cbf765686fb6c1d8f2530b3daf6c66efc92f5d - Patch | |
| References | () https://git.kernel.org/stable/c/e7a38ecda2498e7ce998793ac2a46ca47317635d - Patch | |
| References | () https://git.kernel.org/stable/c/fade67c88870f497a13ed450ba01f7236c92dd9b - Patch |
08 May 2026, 13:16
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.8 |
06 May 2026, 12:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-05-06 12:16
Updated : 2026-05-11 18:16
NVD link : CVE-2026-43256
Mitre link : CVE-2026-43256
CVE.ORG link : CVE-2026-43256
JSON object : View
Products Affected
linux
- linux_kernel
CWE
CWE-125
Out-of-bounds Read