CVE-2026-68219

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:LAttack vector, local

The vulnerability is reached exclusively through V4L2 ioctls (VIDIOC_S_FMT on the /dev/videoX M2M node, or VIDIOC_SUBDEV_S_SELECTION on the ISI pipe subdev), which require local access to the device node. There is no remote or adjacent-network path into the imx8-isi driver.

AC:LAttack complexity, low

Exploitation is a deterministic ioctl sequence: set a large OUTPUT format, set a 1x1 CAPTURE format (accepted because the bound was only min() against the source size and MXC_ISI_MIN_WIDTH/HEIGHT = 1), queue buffers and stream. No race, timing window, or uncontrollable memory-layout condition is involved.

PR:LPrivileges required, low

The attacker only needs to open the ISI video device node; no capability check exists anywhere along the path from the ioctl handler to mxc_isi_channel_set_scaling(). On the i.MX8 embedded, automotive and vision devices where this driver runs, /dev/video* is routinely accessible to ordinary unprivileged applications via the video/camera group.

UI:NUser interaction, none

The attacking process performs the entire sequence itself — open, S_FMT, REQBUFS, QBUF, STREAMON — with no victim action, no separate privileged process, and no administrator step required.

S:UScope, unchanged

The corruption and the hang stay within the kernel of the same machine; the ISI DMA write targets kernel memory adjacent to the video buffer and does not cross a VM, hypervisor or IOMMU security boundary.

C:HConfidentiality impact, high

The scaler saturates at a 16x factor while the destination buffer and CHNL_OUT_BUF_PITCH are sized from the far smaller requested format, so the ISI DMA engine overruns the video buffer into adjacent kernel memory; such heap corruption in DMA-able memory is leverageable to disclose kernel memory contents, and stale buffer content is returned to userspace.

I:HIntegrity impact, high

The hardware writes an image much larger than the allocated destination buffer, producing an out-of-bounds DMA write whose contents are the attacker's own input frame in M2M mode — an attacker-controlled overwrite of kernel memory following the buffer, sufficient for control-flow-relevant corruption.

A:HAvailability impact, high

The fix commit states the transaction never completes and "the process will not respond even when Ctrl+C is executed", leaving an unkillable task and a wedged ISI channel that denies the imaging pipeline to all users; the accompanying out-of-bounds DMA write can additionally panic the kernel.