CVE-2026-68230

Received Received - Intake

Buffer Overflow in Linux Kernel Amlogic C3 ISP

Publication date: 2026-08-10

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: media: amlogic-c3: Add validations for ae and awb config Avoid invalid memory access if the zones_num is bigger than zone_weight. This patch fixes the following smatch errors: drivers/media/platform/amlogic/c3/isp/c3-isp-params.c:111 c3_isp_params_awb_wt() error: buffer overflow 'cfg->zone_weight' 768 <= u32max drivers/media/platform/amlogic/c3/isp/c3-isp-params.c:111 c3_isp_params_awb_wt() error: buffer overflow 'cfg->zone_weight' 768 <= u32max drivers/media/platform/amlogic/c3/isp/c3-isp-params.c:227 c3_isp_params_ae_wt() error: buffer overflow 'cfg->zone_weight' 255 <= u32max drivers/media/platform/amlogic/c3/isp/c3-isp-params.c:227 c3_isp_params_ae_wt() error: buffer overflow 'cfg->zone_weight' 255 <= u32max

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-10

Last Modified

2026-08-17

Generated

2026-08-30

AI Q&A

2026-08-10

EPSS Evaluated

2026-08-29

NVD

CVE-2026-68230

EUVD

EUVD-2026-55331

Affected Vendors & Products

Vendor	Product	Version / Range
amlogic	c3	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a buffer overflow in the amlogic-c3 media driver. It occurs when the zones_num value exceeds zone_weight, leading to invalid memory access. The patch adds validations to prevent this issue in the AWB and AE configuration functions.

Detection Guidance

This vulnerability is specific to the Linux kernel's media subsystem, particularly the amlogic-c3 driver. Detection requires checking kernel logs for buffer overflow errors related to zone_weight in the c3-isp-params module. Use commands like dmesg | grep -i 'buffer overflow' or journalctl -k | grep -i 'zone_weight' to identify issues.

Impact Analysis

The vulnerability could cause system instability or crashes due to memory corruption. An attacker with local access might exploit this to execute arbitrary code or escalate privileges on affected systems running the vulnerable Linux kernel.

Compliance Impact

This vulnerability involves a buffer overflow in the Linux kernel's media subsystem for the Amlogic C3 platform. It does not directly relate to data privacy or security standards like GDPR or HIPAA, as it pertains to memory handling in a media processing component rather than data protection or access control.

Mitigation Strategies

Apply the kernel patch that resolves this issue. Update your Linux kernel to a version containing the fix for the amlogic-c3 driver. Monitor kernel logs for any remaining buffer overflow errors after applying the patch.

Hi! I’m here to help you understand CVE-2026-68230. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70