CVE-2026-68230

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:LAttack vector, local

The vulnerability is reached only through the local V4L2 meta-output device node of the Amlogic C3 ISP driver, by opening /dev/videoX and issuing VIDIOC_QBUF plus VIDIOC_STREAMON ioctls. No network or adjacent-network path exists.

AC:LAttack complexity, low

Both horiz_zones_num and vert_zones_num are copied verbatim from the queued parameters buffer with no validation, so setting them to 0xff deterministically produces a ~64KB out-of-bounds read on every stream start. No race, timing, or memory-layout condition is involved.

PR:LPrivileges required, low

The attacker only needs read/write access to the ISP parameters video node (typically group video, or the camera service/HAL user on Android-class devices); no CAP_SYS_ADMIN or root is required, and every ioctl on the path is unprivileged.

UI:NUser interaction, none

The attacking process queues the malformed parameter buffer and starts streaming entirely on its own; no action by any other user or victim process is needed.

S:UScope, unchanged

The out-of-bounds access occurs in kernel memory within the same security authority as the kernel itself; no VM, IOMMU, or sandbox boundary is crossed.

C:HConfidentiality impact, high

zones_num can reach 255*255=65025 against a 255-byte (AE) or 768-byte (AWB) array inside a ~1.7KB kvmalloc buffer, so up to ~64KB of adjacent kernel heap is read out of bounds and pushed into device state — a large, attacker-positioned disclosure of kernel memory rather than a few strictly bounded bytes.

I:LIntegrity impact, low

The loop performs thousands of writes (up to 8128 register writes) of out-of-bounds heap data into the auto-incrementing AE/AWB weight LUT, far beyond its 32/96-entry depth, corrupting ISP hardware configuration and the statistics delivered to userspace; no arbitrary kernel memory write is available.

A:HAvailability impact, high

Reading ~64KB past the end of a slab object can hit an unmapped or poisoned page and oops; the same code runs from c3_isp_params_isr() in interrupt context under spinlock_irqsave, where a fault reliably results in a kernel panic, and it is also an immediate KASAN slab-out-of-bounds.