{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-68219","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2026-07-30T09:28:09.375Z","datePublished":"2026-08-10T12:00:39.405Z","dateUpdated":"2026-08-17T05:01:05.813Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-17T05:01:05.813Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: nxp: imx8-isi: Fix potential out-of-bounds issues\n\nThe maximum downscaling factor supported by ISI can be up to 16. Add\nminimum value constraint before applying the setting to hardware.\nOtherwise, the process will not respond even when Ctrl+C is executed."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerability is reached exclusively through V4L2 ioctls (VIDIOC_S_FMT on the /dev/videoX M2M node, or VIDIOC_SUBDEV_S_SELECTION on the ISI pipe subdev), which require local access to the device node. There is no remote or adjacent-network path into the imx8-isi driver.\nAC:L - Exploitation is a deterministic ioctl sequence: set a large OUTPUT format, set a 1x1 CAPTURE format (accepted because the bound was only min() against the source size and MXC_ISI_MIN_WIDTH/HEIGHT = 1), queue buffers and stream. No race, timing window, or uncontrollable memory-layout condition is involved.\nPR:L - The attacker only needs to open the ISI video device node; no capability check exists anywhere along the path from the ioctl handler to mxc_isi_channel_set_scaling(). On the i.MX8 embedded, automotive and vision devices where this driver runs, /dev/video* is routinely accessible to ordinary unprivileged applications via the video/camera group.\nUI:N - The attacking process performs the entire sequence itself — open, S_FMT, REQBUFS, QBUF, STREAMON — with no victim action, no separate privileged process, and no administrator step required.\nS:U - The corruption and the hang stay within the kernel of the same machine; the ISI DMA write targets kernel memory adjacent to the video buffer and does not cross a VM, hypervisor or IOMMU security boundary.\nC:H - The scaler saturates at a 16x factor while the destination buffer and CHNL_OUT_BUF_PITCH are sized from the far smaller requested format, so the ISI DMA engine overruns the video buffer into adjacent kernel memory; such heap corruption in DMA-able memory is leverageable to disclose kernel memory contents, and stale buffer content is returned to userspace.\nI:H - The hardware writes an image much larger than the allocated destination buffer, producing an out-of-bounds DMA write whose contents are the attacker's own input frame in M2M mode — an attacker-controlled overwrite of kernel memory following the buffer, sufficient for control-flow-relevant corruption.\nA:H - The fix commit states the transaction never completes and \"the process will not respond even when Ctrl+C is executed\", leaving an unkillable task and a wedged ISI channel that denies the imaging pipeline to all users; the accompanying out-of-bounds DMA write can additionally panic the kernel."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/media/platform/nxp/imx8-isi/imx8-isi-core.h","drivers/media/platform/nxp/imx8-isi/imx8-isi-m2m.c","drivers/media/platform/nxp/imx8-isi/imx8-isi-pipe.c"],"versions":[{"version":"cf21f328fcafacf4f96e7a30ef9dceede1076378","lessThan":"690cdda752f3dc6b7a8b2d4a243e0207b66a1f37","status":"affected","versionType":"git"},{"version":"cf21f328fcafacf4f96e7a30ef9dceede1076378","lessThan":"ba7e1b06cbdad3b7c3314390cca22aff42f655d4","status":"affected","versionType":"git"},{"version":"cf21f328fcafacf4f96e7a30ef9dceede1076378","lessThan":"28ae75dba701d7aa69a36802c398582933d3e0e6","status":"affected","versionType":"git"},{"version":"cf21f328fcafacf4f96e7a30ef9dceede1076378","lessThan":"75cdfaa7c908ca06d564170da9c80fb579f149a5","status":"affected","versionType":"git"},{"version":"cf21f328fcafacf4f96e7a30ef9dceede1076378","lessThan":"57a7ec5c9f38ce6c4d6209c4b75c8e57e1fea6cf","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/media/platform/nxp/imx8-isi/imx8-isi-core.h","drivers/media/platform/nxp/imx8-isi/imx8-isi-m2m.c","drivers/media/platform/nxp/imx8-isi/imx8-isi-pipe.c"],"versions":[{"version":"6.4","status":"affected"},{"version":"0","lessThan":"6.4","status":"unaffected","versionType":"semver"},{"version":"6.6.148","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.12.101","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.18.42","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.1.6","lessThanOrEqual":"7.1.*","status":"unaffected","versionType":"semver"},{"version":"7.2","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.4","versionEndExcluding":"6.6.148"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.4","versionEndExcluding":"6.12.101"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.4","versionEndExcluding":"6.18.42"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.4","versionEndExcluding":"7.1.6"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.4","versionEndExcluding":"7.2"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/690cdda752f3dc6b7a8b2d4a243e0207b66a1f37"},{"url":"https://git.kernel.org/stable/c/ba7e1b06cbdad3b7c3314390cca22aff42f655d4"},{"url":"https://git.kernel.org/stable/c/28ae75dba701d7aa69a36802c398582933d3e0e6"},{"url":"https://git.kernel.org/stable/c/75cdfaa7c908ca06d564170da9c80fb579f149a5"},{"url":"https://git.kernel.org/stable/c/57a7ec5c9f38ce6c4d6209c4b75c8e57e1fea6cf"}],"title":"media: nxp: imx8-isi: Fix potential out-of-bounds issues","x_generator":{"engine":"bippy-1.2.0"}}}}