In the Linux kernel, the following vulnerability has been resolved:
media: cx23885: Fix a null-ptr-deref bug in buffer_prepare() and buffer_finish()
When the driver calls cx23885_risc_buffer() to prepare the buffer, the function call dma_alloc_coherent may fail, resulting in a empty buffer risc->cpu. Later when we free the buffer or access the buffer, null ptr deref is triggered.
This bug is similar to the following one: https://git.linuxtv.org/media_stage.git/commit/?id=2b064d91440b33fba5b452f2d1b31f13ae911d71.
We believe the bug can be also dynamically triggered from user side. Similarly, we fix this by checking the return value of cx23885_risc_buffer() and the value of risc->cpu before buffer free.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Oct 3, 2025 | Oct 3, 2025 |
| Redhat_linux | — | No solution exists | Jul 17, 2026 | Oct 1, 2025 |
| Ubuntu | — | Upgrade linux-bluefieldUpgrade linux-hwe-5.15Upgrade linux-raspiUpgrade linux-nvidia-tegraUpgrade linux-awsUpgrade linux-lowlatency-hwe-5.15Upgrade linux-realtimeUpgrade linux-gcp-5.15Upgrade linux-riscv-5.15Upgrade linux-aws-5.15Upgrade linux-gkeUpgrade linux-nvidia-tegra-5.15Upgrade linux-ibm-5.15Upgrade linux-azureUpgrade linux-lowlatencyUpgrade linux-ibmUpgrade linux-kvmUpgrade linux-gkeopUpgrade linux-oracleUpgrade linux-gcpUpgrade linux-intel-iotg-5.15Upgrade linux-nvidia-tegra-igxUpgrade linux-intel-iot-realtimeUpgrade linuxUpgrade linux-xilinx-zynqmpUpgrade linux-azure-5.15Upgrade linux-azure-fde-5.15Upgrade linux-oracle-5.15Upgrade linux-intel-iotgUpgrade linux-nvidia | Oct 10, 2025 | Oct 1, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub