The Linux kernel's media vicodec FWHT encoder had an out-of-bounds write vulnerability in the vidioc_s_fmt_vid_out() function. This function sized the encoder capture buffer based on a size multiplier of 3, but encoding a 4-component pixel format frame where all planes are unencoded caused the actual write size to exceed the buffer by coded_w * coded_h bytes. This buffer overrun could corrupt adjacent kernel heap memory. The vulnerability was fixed by increasing the size multiplier from 3 to 4, matching the largest number of components among supported raw formats, ensuring the buffer is always large enough for the unencoded fallback path.

The vulnerability can lead to corruption of adjacent kernel heap memory due to an out-of-bounds write during video encoding operations in the Linux kernel media subsystem. This memory corruption could potentially cause system instability or other unintended behavior. No information about active exploitation or further impact is provided.

A fix is available that increases the capture buffer size multiplier from 3 to 4 in the FWHT encoder to prevent out-of-bounds writes. Users should apply the official Linux kernel updates that include this fix. No additional mitigation steps are indicated.