Description
In the Linux kernel, the following vulnerability has been resolved:
media: dvb-frontends: dib7090p: fix null-ptr-deref in dib7090p_rw_on_apb()
In dib7090p_rw_on_apb, msg is controlled by user. When msg[0].buf is null and msg[0].len is zero, former checks on msg[0].buf would be passed. If accessing msg[0].buf[2] without sanity check, null pointer deref would happen. We add check on msg[0].len to prevent crash. Similar issue occurs when access msg[1].buf[0] and msg[1].buf[1].
Similar commit: commit 0ed554fd769a ("media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()")
Metrics
CVSS 3.1 5.5/10
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HWeakness enumeration
Affected software
| Vendor | Product | Versions |
|---|---|---|
| Linux | Linux | >= 713d54a8bd812229410a1902cd9b332a2a27af9f, < bc07cae4f36bb18d5b6a9ed835c1278ca44ec82e; >= 713d54a8bd812229410a1902cd9b332a2a27af9f, < ce8b7c711b9c4f040b5419729d0972db8e374324; >= 713d54a8bd812229410a1902cd9b332a2a27af9f, < 529fd5593b721e6f4370c591f5086649ed149ff6; >= 713d54a8bd812229410a1902cd9b332a2a27af9f, < c33280d6bd668dbdc5a5f07887cc63a52ab4789c; >= 713d54a8bd812229410a1902cd9b332a2a27af9f, < 09906650484a09b3a4d4b3d3065395856810becd; >= 713d54a8bd812229410a1902cd9b332a2a27af9f, < 0bb32863426afe0badac25c28d59021f211d0f48; >= 713d54a8bd812229410a1902cd9b332a2a27af9f, < a0f744d6cdde81d7382e183f77a4080a39b206cd; >= 713d54a8bd812229410a1902cd9b332a2a27af9f, < 19eb5d8e6aa1169d368a4d69aae5572950deb89d; >= 713d54a8bd812229410a1902cd9b332a2a27af9f, < ce5cac69b2edac3e3246fee03e8f4c2a1075238b |
| Linux | Linux | 2.6.39 |
| Siemens | SIMATIC CN 4100 | < V5.0 |
References
- https://git.kernel.org/stable/c/09906650484a09b3a4d4b3d3065395856810becdPatch
- https://git.kernel.org/stable/c/0bb32863426afe0badac25c28d59021f211d0f48Patch
- https://git.kernel.org/stable/c/19eb5d8e6aa1169d368a4d69aae5572950deb89dPatch
- https://git.kernel.org/stable/c/529fd5593b721e6f4370c591f5086649ed149ff6Patch
- https://git.kernel.org/stable/c/a0f744d6cdde81d7382e183f77a4080a39b206cdPatch
- https://git.kernel.org/stable/c/bc07cae4f36bb18d5b6a9ed835c1278ca44ec82ePatch
- https://git.kernel.org/stable/c/c33280d6bd668dbdc5a5f07887cc63a52ab4789cPatch
- https://git.kernel.org/stable/c/ce5cac69b2edac3e3246fee03e8f4c2a1075238bPatch
- https://git.kernel.org/stable/c/ce8b7c711b9c4f040b5419729d0972db8e374324Patch
- https://lists.debian.org/debian-lts-announce/2025/10/msg00007.htmlThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2025/10/msg00008.htmlThird Party Advisory
- https://cert-portal.siemens.com/productcert/html/ssa-032379.html
Timeline
- Published
- Sep 4, 2025
- Last modified
- Nov 5, 2026
- NVD status
- Modified