In the Linux kernel, the following vulnerability has been resolved:
media: dvb-frontends: dib7090p: fix null-ptr-deref in dib7090prwon_apb()
In dib7090prwon_apb, msg is controlled by user. When msg[0].buf is null and msg[0].len is zero, former checks on msg[0].buf would be passed. If accessing msg[0].buf[2] without sanity check, null pointer deref would happen. We add check on msg[0].len to prevent crash. Similar issue occurs when access msg[1].buf[0] and msg[1].buf[1].
Similar commit: commit 0ed554fd769a ("media: dvb-usb: az6027: fix null-ptr-deref in az6027i2cxfer()")
[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ce5cac69b2edac3e3246fee03e8f4c2a1075238b",
"deprecated": false,
"digest": {
"function_hash": "107811926567043512889569427340964422984",
"length": 410.0
},
"target": {
"function": "dib7090p_rw_on_apb",
"file": "drivers/media/dvb-frontends/dib7000p.c"
},
"id": "CVE-2025-38694-0d10a86b",
"signature_version": "v1",
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@09906650484a09b3a4d4b3d3065395856810becd",
"deprecated": false,
"digest": {
"line_hashes": [
"338696589541243122575772254410246410691",
"276380789820911263275458768670038765722",
"76986435499237995989855202152494490485",
"334052803025408930601094952886512345830",
"147618893471621612264698609023575684572",
"242279810063775718309552697369348077959"
],
"threshold": 0.9
},
"target": {
"file": "drivers/media/dvb-frontends/dib7000p.c"
},
"id": "CVE-2025-38694-290b21ae",
"signature_version": "v1",
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a0f744d6cdde81d7382e183f77a4080a39b206cd",
"deprecated": false,
"digest": {
"function_hash": "107811926567043512889569427340964422984",
"length": 410.0
},
"target": {
"function": "dib7090p_rw_on_apb",
"file": "drivers/media/dvb-frontends/dib7000p.c"
},
"id": "CVE-2025-38694-663efbb9",
"signature_version": "v1",
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ce8b7c711b9c4f040b5419729d0972db8e374324",
"deprecated": false,
"digest": {
"function_hash": "107811926567043512889569427340964422984",
"length": 410.0
},
"target": {
"function": "dib7090p_rw_on_apb",
"file": "drivers/media/dvb-frontends/dib7000p.c"
},
"id": "CVE-2025-38694-816297fc",
"signature_version": "v1",
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0bb32863426afe0badac25c28d59021f211d0f48",
"deprecated": false,
"digest": {
"function_hash": "107811926567043512889569427340964422984",
"length": 410.0
},
"target": {
"function": "dib7090p_rw_on_apb",
"file": "drivers/media/dvb-frontends/dib7000p.c"
},
"id": "CVE-2025-38694-8a52a9d3",
"signature_version": "v1",
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a0f744d6cdde81d7382e183f77a4080a39b206cd",
"deprecated": false,
"digest": {
"line_hashes": [
"338696589541243122575772254410246410691",
"276380789820911263275458768670038765722",
"76986435499237995989855202152494490485",
"334052803025408930601094952886512345830",
"147618893471621612264698609023575684572",
"242279810063775718309552697369348077959"
],
"threshold": 0.9
},
"target": {
"file": "drivers/media/dvb-frontends/dib7000p.c"
},
"id": "CVE-2025-38694-8c70a3f5",
"signature_version": "v1",
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bc07cae4f36bb18d5b6a9ed835c1278ca44ec82e",
"deprecated": false,
"digest": {
"function_hash": "107811926567043512889569427340964422984",
"length": 410.0
},
"target": {
"function": "dib7090p_rw_on_apb",
"file": "drivers/media/dvb-frontends/dib7000p.c"
},
"id": "CVE-2025-38694-996aab44",
"signature_version": "v1",
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0bb32863426afe0badac25c28d59021f211d0f48",
"deprecated": false,
"digest": {
"line_hashes": [
"338696589541243122575772254410246410691",
"276380789820911263275458768670038765722",
"76986435499237995989855202152494490485",
"334052803025408930601094952886512345830",
"147618893471621612264698609023575684572",
"242279810063775718309552697369348077959"
],
"threshold": 0.9
},
"target": {
"file": "drivers/media/dvb-frontends/dib7000p.c"
},
"id": "CVE-2025-38694-9e0b7f33",
"signature_version": "v1",
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@529fd5593b721e6f4370c591f5086649ed149ff6",
"deprecated": false,
"digest": {
"function_hash": "107811926567043512889569427340964422984",
"length": 410.0
},
"target": {
"function": "dib7090p_rw_on_apb",
"file": "drivers/media/dvb-frontends/dib7000p.c"
},
"id": "CVE-2025-38694-a1adad5b",
"signature_version": "v1",
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c33280d6bd668dbdc5a5f07887cc63a52ab4789c",
"deprecated": false,
"digest": {
"line_hashes": [
"338696589541243122575772254410246410691",
"276380789820911263275458768670038765722",
"76986435499237995989855202152494490485",
"334052803025408930601094952886512345830",
"147618893471621612264698609023575684572",
"242279810063775718309552697369348077959"
],
"threshold": 0.9
},
"target": {
"file": "drivers/media/dvb-frontends/dib7000p.c"
},
"id": "CVE-2025-38694-b6edd388",
"signature_version": "v1",
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bc07cae4f36bb18d5b6a9ed835c1278ca44ec82e",
"deprecated": false,
"digest": {
"line_hashes": [
"338696589541243122575772254410246410691",
"276380789820911263275458768670038765722",
"76986435499237995989855202152494490485",
"334052803025408930601094952886512345830",
"147618893471621612264698609023575684572",
"242279810063775718309552697369348077959"
],
"threshold": 0.9
},
"target": {
"file": "drivers/media/dvb-frontends/dib7000p.c"
},
"id": "CVE-2025-38694-c74adb7b",
"signature_version": "v1",
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@529fd5593b721e6f4370c591f5086649ed149ff6",
"deprecated": false,
"digest": {
"line_hashes": [
"338696589541243122575772254410246410691",
"276380789820911263275458768670038765722",
"76986435499237995989855202152494490485",
"334052803025408930601094952886512345830",
"147618893471621612264698609023575684572",
"242279810063775718309552697369348077959"
],
"threshold": 0.9
},
"target": {
"file": "drivers/media/dvb-frontends/dib7000p.c"
},
"id": "CVE-2025-38694-c8959284",
"signature_version": "v1",
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ce5cac69b2edac3e3246fee03e8f4c2a1075238b",
"deprecated": false,
"digest": {
"line_hashes": [
"338696589541243122575772254410246410691",
"276380789820911263275458768670038765722",
"76986435499237995989855202152494490485",
"334052803025408930601094952886512345830",
"147618893471621612264698609023575684572",
"242279810063775718309552697369348077959"
],
"threshold": 0.9
},
"target": {
"file": "drivers/media/dvb-frontends/dib7000p.c"
},
"id": "CVE-2025-38694-db1637bb",
"signature_version": "v1",
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ce8b7c711b9c4f040b5419729d0972db8e374324",
"deprecated": false,
"digest": {
"line_hashes": [
"338696589541243122575772254410246410691",
"276380789820911263275458768670038765722",
"76986435499237995989855202152494490485",
"334052803025408930601094952886512345830",
"147618893471621612264698609023575684572",
"242279810063775718309552697369348077959"
],
"threshold": 0.9
},
"target": {
"file": "drivers/media/dvb-frontends/dib7000p.c"
},
"id": "CVE-2025-38694-e2589241",
"signature_version": "v1",
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c33280d6bd668dbdc5a5f07887cc63a52ab4789c",
"deprecated": false,
"digest": {
"function_hash": "107811926567043512889569427340964422984",
"length": 410.0
},
"target": {
"function": "dib7090p_rw_on_apb",
"file": "drivers/media/dvb-frontends/dib7000p.c"
},
"id": "CVE-2025-38694-e31c9469",
"signature_version": "v1",
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@09906650484a09b3a4d4b3d3065395856810becd",
"deprecated": false,
"digest": {
"function_hash": "107811926567043512889569427340964422984",
"length": 410.0
},
"target": {
"function": "dib7090p_rw_on_apb",
"file": "drivers/media/dvb-frontends/dib7000p.c"
},
"id": "CVE-2025-38694-e7dc0d35",
"signature_version": "v1",
"signature_type": "Function"
}
]