In the Linux kernel, the following vulnerability has been resolved:
media: cx23885: Fix a null-ptr-deref bug in buffer_prepare() and buffer_finish()
When the driver calls cx23885_risc_buffer() to prepare the buffer, the function call dma_alloc_coherent may fail, resulting in a empty buffer risc->cpu. Later when we free the buffer or access the buffer, null ptr deref is triggered.
This bug is similar to the following one: https://git.linuxtv.org/media_stage.git/commit/?id=2b064d91440b33fba5b452f2d1b31f13ae911d71.
We believe the bug can be also dynamically triggered from user side. Similarly, we fix this by checking the return value of cx23885_risc_buffer() and the value of risc->cpu before buffer free.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Oct 3, 2025 | Oct 3, 2025 |
| Redhat_linux | — | No solution exists | Jul 17, 2026 | Oct 1, 2025 |
| Ubuntu | — | Upgrade linux-gcp-5.15Upgrade linux-awsUpgrade linux-azureUpgrade linux-bluefieldUpgrade linux-realtimeUpgrade linux-lowlatencyUpgrade linux-aws-5.15Upgrade linux-lowlatency-hwe-5.15Upgrade linux-gkeUpgrade linux-hwe-5.15Upgrade linux-nvidia-tegra-5.15Upgrade linux-nvidia-tegraUpgrade linux-raspiUpgrade linux-azure-fdeUpgrade linux-ibm-5.15Upgrade linux-riscv-5.15Upgrade linux-nvidiaUpgrade linux-intel-iotg-5.15Upgrade linuxUpgrade linux-oracle-5.15Upgrade linux-ibmUpgrade linux-intel-iot-realtimeUpgrade linux-azure-fde-5.15Upgrade linux-azure-5.15Upgrade linux-gkeopUpgrade linux-gcpUpgrade linux-xilinx-zynqmpUpgrade linux-nvidia-tegra-igxUpgrade linux-intel-iotgUpgrade linux-oracleUpgrade linux-kvm | Oct 10, 2025 | Oct 1, 2025 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub