CVE-2026-68230 (GCVE-0-2026-68230)

Vulnerability from cvelistv5 – Published: 2026-08-10 12:00 – Updated: 2026-08-17 05:01
VLAI
Title
media: amlogic-c3: Add validations for ae and awb config
Summary
In the Linux kernel, the following vulnerability has been resolved: media: amlogic-c3: Add validations for ae and awb config Avoid invalid memory access if the zones_num is bigger than zone_weight. This patch fixes the following smatch errors: drivers/media/platform/amlogic/c3/isp/c3-isp-params.c:111 c3_isp_params_awb_wt() error: buffer overflow 'cfg->zone_weight' 768 <= u32max drivers/media/platform/amlogic/c3/isp/c3-isp-params.c:111 c3_isp_params_awb_wt() error: buffer overflow 'cfg->zone_weight' 768 <= u32max drivers/media/platform/amlogic/c3/isp/c3-isp-params.c:227 c3_isp_params_ae_wt() error: buffer overflow 'cfg->zone_weight' 255 <= u32max drivers/media/platform/amlogic/c3/isp/c3-isp-params.c:227 c3_isp_params_ae_wt() error: buffer overflow 'cfg->zone_weight' 255 <= u32max
Severity
7.3 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: fb2e135208f364f26b7579c191434d38655e813f , < 391fe3e36e59f3c6e3d46edfb3a5de51e00cd216 (git)
Affected: fb2e135208f364f26b7579c191434d38655e813f , < 32cbe5474e74817aa8a576b94135cc45e59f5e07 (git)
Affected: fb2e135208f364f26b7579c191434d38655e813f , < 9724164f71974a2a44a5e026614fbcc05bab6d91 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.16
Unaffected: 0 , < 6.16 (semver)
Unaffected: 6.18.42 , ≤ 6.18.* (semver)
Unaffected: 7.1.6 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/media/platform/amlogic/c3/isp/c3-isp-params.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "391fe3e36e59f3c6e3d46edfb3a5de51e00cd216",
              "status": "affected",
              "version": "fb2e135208f364f26b7579c191434d38655e813f",
              "versionType": "git"
            },
            {
              "lessThan": "32cbe5474e74817aa8a576b94135cc45e59f5e07",
              "status": "affected",
              "version": "fb2e135208f364f26b7579c191434d38655e813f",
              "versionType": "git"
            },
            {
              "lessThan": "9724164f71974a2a44a5e026614fbcc05bab6d91",
              "status": "affected",
              "version": "fb2e135208f364f26b7579c191434d38655e813f",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/media/platform/amlogic/c3/isp/c3-isp-params.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.16"
            },
            {
              "lessThan": "6.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.42",
                  "versionStartIncluding": "6.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.6",
                  "versionStartIncluding": "6.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: amlogic-c3: Add validations for ae and awb config\n\nAvoid invalid memory access if the zones_num is bigger than\nzone_weight.\n\nThis patch fixes the following smatch errors:\ndrivers/media/platform/amlogic/c3/isp/c3-isp-params.c:111 c3_isp_params_awb_wt() error: buffer overflow \u0027cfg-\u003ezone_weight\u0027 768 \u003c= u32max\ndrivers/media/platform/amlogic/c3/isp/c3-isp-params.c:111 c3_isp_params_awb_wt() error: buffer overflow \u0027cfg-\u003ezone_weight\u0027 768 \u003c= u32max\ndrivers/media/platform/amlogic/c3/isp/c3-isp-params.c:227 c3_isp_params_ae_wt() error: buffer overflow \u0027cfg-\u003ezone_weight\u0027 255 \u003c= u32max\ndrivers/media/platform/amlogic/c3/isp/c3-isp-params.c:227 c3_isp_params_ae_wt() error: buffer overflow \u0027cfg-\u003ezone_weight\u0027 255 \u003c= u32max"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is reached only through the local V4L2 meta-output device node of the Amlogic C3 ISP driver, by opening /dev/videoX and issuing VIDIOC_QBUF plus VIDIOC_STREAMON ioctls. No network or adjacent-network path exists.\nAC:L - Both horiz_zones_num and vert_zones_num are copied verbatim from the queued parameters buffer with no validation, so setting them to 0xff deterministically produces a ~64KB out-of-bounds read on every stream start. No race, timing, or memory-layout condition is involved.\nPR:L - The attacker only needs read/write access to the ISP parameters video node (typically group video, or the camera service/HAL user on Android-class devices); no CAP_SYS_ADMIN or root is required, and every ioctl on the path is unprivileged.\nUI:N - The attacking process queues the malformed parameter buffer and starts streaming entirely on its own; no action by any other user or victim process is needed.\nS:U - The out-of-bounds access occurs in kernel memory within the same security authority as the kernel itself; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - zones_num can reach 255*255=65025 against a 255-byte (AE) or 768-byte (AWB) array inside a ~1.7KB kvmalloc buffer, so up to ~64KB of adjacent kernel heap is read out of bounds and pushed into device state \u2014 a large, attacker-positioned disclosure of kernel memory rather than a few strictly bounded bytes.\nI:L - The loop performs thousands of writes (up to 8128 register writes) of out-of-bounds heap data into the auto-incrementing AE/AWB weight LUT, far beyond its 32/96-entry depth, corrupting ISP hardware configuration and the statistics delivered to userspace; no arbitrary kernel memory write is available.\nA:H - Reading ~64KB past the end of a slab object can hit an unmapped or poisoned page and oops; the same code runs from c3_isp_params_isr() in interrupt context under spinlock_irqsave, where a fault reliably results in a kernel panic, and it is also an immediate KASAN slab-out-of-bounds."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:01:18.566Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/391fe3e36e59f3c6e3d46edfb3a5de51e00cd216"
        },
        {
          "url": "https://git.kernel.org/stable/c/32cbe5474e74817aa8a576b94135cc45e59f5e07"
        },
        {
          "url": "https://git.kernel.org/stable/c/9724164f71974a2a44a5e026614fbcc05bab6d91"
        }
      ],
      "title": "media: amlogic-c3: Add validations for ae and awb config",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-68230",
    "datePublished": "2026-08-10T12:00:53.425Z",
    "dateReserved": "2026-07-30T09:28:09.376Z",
    "dateUpdated": "2026-08-17T05:01:18.566Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-68230",
      "date": "2026-09-21",
      "epss": "0.0017",
      "percentile": "0.06727"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/media/platform/amlogic/c3/isp/c3-isp-params.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "391fe3e36e59f3c6e3d46edfb3a5de51e00cd216",
                    "status": "affected",
                    "version": "fb2e135208f364f26b7579c191434d38655e813f",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "32cbe5474e74817aa8a576b94135cc45e59f5e07",
                    "status": "affected",
                    "version": "fb2e135208f364f26b7579c191434d38655e813f",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "9724164f71974a2a44a5e026614fbcc05bab6d91",
                    "status": "affected",
                    "version": "fb2e135208f364f26b7579c191434d38655e813f",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/media/platform/amlogic/c3/isp/c3-isp-params.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.16"
                  },
                  {
                    "lessThan": "6.16",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.42",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.6",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: amlogic-c3: Add validations for ae and awb config\n\nAvoid invalid memory access if the zones_num is bigger than\nzone_weight.\n\nThis patch fixes the following smatch errors:\ndrivers/media/platform/amlogic/c3/isp/c3-isp-params.c:111 c3_isp_params_awb_wt() error: buffer overflow \u0027cfg-\u003ezone_weight\u0027 768 \u003c= u32max\ndrivers/media/platform/amlogic/c3/isp/c3-isp-params.c:111 c3_isp_params_awb_wt() error: buffer overflow \u0027cfg-\u003ezone_weight\u0027 768 \u003c= u32max\ndrivers/media/platform/amlogic/c3/isp/c3-isp-params.c:227 c3_isp_params_ae_wt() error: buffer overflow \u0027cfg-\u003ezone_weight\u0027 255 \u003c= u32max\ndrivers/media/platform/amlogic/c3/isp/c3-isp-params.c:227 c3_isp_params_ae_wt() error: buffer overflow \u0027cfg-\u003ezone_weight\u0027 255 \u003c= u32max"
          }
        ],
        "id": "CVE-2026-68230",
        "lastModified": "2026-08-17T05:18:25.280",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.3,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "LOW",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.5,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-08-10T13:20:11.250",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/32cbe5474e74817aa8a576b94135cc45e59f5e07"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/391fe3e36e59f3c6e3d46edfb3a5de51e00cd216"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/9724164f71974a2a44a5e026614fbcc05bab6d91"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-08-11T15:34:17+00:00",
      "cve": "CVE-2026-68230",
      "id": "CVE-2026-68230",
      "initial_release_date": "2026-08-10T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: media: amlogic-c3: Add validations for ae and awb config",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68230.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-21T00:44:44Z",
      "cve": "CVE-2026-68230",
      "id": "CVE-2026-68230",
      "initial_release_date": "2026-08-21T00:44:44Z",
      "product_status:known_not_affected": "296",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-68230",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-68230.json",
      "version": "2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.