{"id":"CVE-2026-59618","kind":"vulnerability","aliases":["CVE-2026-59618"],"related":[],"title":"Linux kernel: integer overflow in V4L2 selection code leaks adjacent memory","description":"In smfc_v4l2_s_selection of smfc-v4l2-ioctls.c, there is a possible way to trigger an out of bounds read from adjacent shared memory buffers due to an integer overflow. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.","summary":"A flaw in the smfc V4L2 selection ioctl handler lets a local process trigger an out-of-bounds read caused by an integer overflow. An attacker with local access can read adjacent shared memory buffers, which discloses information without needing extra privileges.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","linux-kernel","local-users","v4l2"],"not_affected_if":["driver-not-loaded","no-local-untrusted-users"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T20:19:31+00:00","first_seen_at":"2026-11-10T20:46:14+00:00","triaged_at":"2026-11-10T20:49:38+00:00","updated_at":"2026-11-10T20:49:38+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T20:49:38Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Linux kernel: integer overflow in V4L2 selection code leaks adjacent memory","impact":"low","summary":"A flaw in the smfc V4L2 selection ioctl handler lets a local process trigger an out-of-bounds read caused by an integer overflow. An attacker with local access can read adjacent shared memory buffers, which discloses information without needing extra privileges.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","v4l2","local-users"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"local process reads adjacent shared memory contents","analyst_note":"Check the NVD and kernel.org or Android security bulletin for affected kernel versions, the smfc driver's build default, and the fixed commit.","how_to_check":"- unknown","plain_action":"","product_name":"linux kernel","needs_analyst":true,"not_affected_if":["driver-not-loaded","no-local-untrusted-users"],"who_is_affected":"Only systems where the smfc V4L2 driver is loaded can be exposed, and the attacker needs local code execution on that machine. The sources do not name affected kernel versions or whether the driver is built in by default, so unknown. Teams running standard servers without this video capture hardware can likely skip it.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000717,"input_tokens":4564,"output_tokens":521,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-59618':14A,17A 'access':55B 'addit':111C 'adjac':10A,58B,93C 'attack':52B 'bound':44B,90C 'buffer':61B,96C 'c':79C 'caus':46B 'code':8A 'could':103C 'cve':12A,15A 'disclos':63B 'disclosur':108C 'due':97C 'execut':112C 'exploit':121C 'extra':67B 'flaw':27B 'handler':34B 'inform':64B,107C 'infrastructur':18B 'integ':3A,49B,100C 'interact':116C 'ioctl':33B,78C 'kernel':2A,21B 'lead':104C 'leak':9A 'let':35B 'linux':1A,20B 'linux-kernel':19B 'local':23B,37B,54B,106C 'local-us':22B 'memori':11A,60B,95C 'need':66B,114C,119C 'out-of-bound':41B 'overflow':4A,50B,101C 'possibl':83C 'privileg':68B,113C 'process':38B 'read':45B,57B,91C 'select':7A,32B,73C 'share':59B,94C 'smfc':30B,70C,76C 'smfc-v4l2-ioctls':75C 'trigger':39B,86C 'user':24B,115C 'v4l2':6A,25B,31B,71C,77C 'way':84C 'without':65B","nicknames":[],"mitigations":[],"who_affected":"Only systems where the smfc V4L2 driver is loaded can be exposed, and the attacker needs local code execution on that machine. The sources do not name affected kernel versions or whether the driver is built in by default, so unknown. Teams running standard servers without this video capture hardware can likely skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["infrastructure","linuxkernel","localusers","unknown","v4l2"],"campaign_type":null,"search_a":"'-2026':13A,16A '-59618':14A,17A 'adjac':10A 'code':8A 'cve':12A,15A 'integ':3A 'kernel':2A 'leak':9A 'linux':1A 'memori':11A 'overflow':4A 'select':7A 'v4l2':6A","search_b":"'access':55B 'adjac':58B 'attack':52B 'bound':44B 'buffer':61B 'caus':46B 'disclos':63B 'extra':67B 'flaw':27B 'handler':34B 'inform':64B 'infrastructur':18B 'integ':49B 'ioctl':33B 'kernel':21B 'let':35B 'linux':20B 'linux-kernel':19B 'local':23B,37B,54B 'local-us':22B 'memori':60B 'need':66B 'out-of-bound':41B 'overflow':50B 'privileg':68B 'process':38B 'read':45B,57B 'select':32B 'share':59B 'smfc':30B 'trigger':39B 'user':24B 'v4l2':25B,31B 'without':65B","search_c":"'addit':111C 'adjac':93C 'bound':90C 'buffer':96C 'c':79C 'could':103C 'disclosur':108C 'due':97C 'execut':112C 'exploit':121C 'inform':107C 'integ':100C 'interact':116C 'ioctl':78C 'lead':104C 'local':106C 'memori':95C 'need':114C,119C 'overflow':101C 'possibl':83C 'privileg':113C 'read':91C 'select':73C 'share':94C 'smfc':70C,76C 'smfc-v4l2-ioctls':75C 'trigger':86C 'user':115C 'v4l2':71C,77C 'way':84C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T20:19:31+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-59618","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59618","severity":null,"published_at":"2026-11-10T20:19:31+00:00","modified_at":"2026-11-10T20:19:31+00:00","first_seen_at":"2026-11-10T20:46:14+00:00","fetched_at":"2026-11-10T20:46:14+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}