CVE-2025-38694: media: dvb-frontends: dib7090p: fix null-ptr-deref in dib7090p_rw_on_apb()
In the Linux kernel, the following vulnerability has been resolved:
media: dvb-frontends: dib7090p: fix null-ptr-deref in dib7090prwonapb()
In dib7090prwonapb, msg is controlled by user. When msg[0].buf is null and msg[0].len is zero, former checks on msg[0].buf would be passed. If accessing msg[0].buf[2] without sanity check, null pointer deref would happen. We add check on msg[0].len to prevent crash. Similar issue occurs when access msg[1].buf[0] and msg[1].buf[1].
Similar commit: commit 0ed554fd769a ("media: dvb-usb: az6027: fix null-ptr-deref in az6027i2cxfer()")
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1 - Compensating control
Add a sanity check on msg[0].len before accessing msg[0].buf[2], and validate message lengths before accessing msg[1].buf[0] or msg[1].buf[1], to prevent null-pointer dereferences in dib7090p_rw_on_apb().
Event History
Frequently Asked Questions
What is the severity of CVE-2025-38694?
CVE-2025-38694 is classified as a medium severity vulnerability in the Linux kernel.
How do I fix CVE-2025-38694?
To fix CVE-2025-38694, you should update the Linux kernel to the latest stable version that addresses this vulnerability.
What is the impact of CVE-2025-38694?
The impact of CVE-2025-38694 includes potential denial of service due to a null pointer dereference.
Which versions of the Linux kernel are affected by CVE-2025-38694?
CVE-2025-38694 affects specific versions of the Linux kernel that are using the dib7090p media driver.
Is CVE-2025-38694 exploitable remotely?
CVE-2025-38694 may be exploitable remotely if the affected media driver is used in a publicly accessible configuration.