In the Linux kernel, the following vulnerability has been resolved:
media: dvb-frontends: dib7090p: fix null-ptr-deref in dib7090prwon_apb()
In dib7090prwon_apb, msg is controlled by user. When msg[0].buf is null and msg[0].len is zero, former checks on msg[0].buf would be passed. If accessing msg[0].buf[2] without sanity check, null pointer deref would happen. We add check on msg[0].len to prevent crash. Similar issue occurs when access msg[1].buf[0] and msg[1].buf[1].
Similar commit: commit 0ed554fd769a ("media: dvb-usb: az6027: fix null-ptr-deref in az6027i2cxfer()")
[
{
"id": "CVE-2025-38694-290b21ae",
"target": {
"file": "drivers/media/dvb-frontends/dib7000p.c"
},
"signature_version": "v1",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@09906650484a09b3a4d4b3d3065395856810becd",
"digest": {
"line_hashes": [
"338696589541243122575772254410246410691",
"276380789820911263275458768670038765722",
"76986435499237995989855202152494490485",
"334052803025408930601094952886512345830",
"147618893471621612264698609023575684572",
"242279810063775718309552697369348077959"
],
"threshold": 0.9
},
"deprecated": false
},
{
"id": "CVE-2025-38694-5af2e990",
"target": {
"function": "dib7090p_rw_on_apb",
"file": "drivers/media/dvb-frontends/dib7000p.c"
},
"signature_version": "v1",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@19eb5d8e6aa1169d368a4d69aae5572950deb89d",
"digest": {
"length": 410.0,
"function_hash": "107811926567043512889569427340964422984"
},
"deprecated": false
},
{
"id": "CVE-2025-38694-663efbb9",
"target": {
"function": "dib7090p_rw_on_apb",
"file": "drivers/media/dvb-frontends/dib7000p.c"
},
"signature_version": "v1",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a0f744d6cdde81d7382e183f77a4080a39b206cd",
"digest": {
"length": 410.0,
"function_hash": "107811926567043512889569427340964422984"
},
"deprecated": false
},
{
"id": "CVE-2025-38694-8a52a9d3",
"target": {
"function": "dib7090p_rw_on_apb",
"file": "drivers/media/dvb-frontends/dib7000p.c"
},
"signature_version": "v1",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0bb32863426afe0badac25c28d59021f211d0f48",
"digest": {
"length": 410.0,
"function_hash": "107811926567043512889569427340964422984"
},
"deprecated": false
},
{
"id": "CVE-2025-38694-8c70a3f5",
"target": {
"file": "drivers/media/dvb-frontends/dib7000p.c"
},
"signature_version": "v1",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a0f744d6cdde81d7382e183f77a4080a39b206cd",
"digest": {
"line_hashes": [
"338696589541243122575772254410246410691",
"276380789820911263275458768670038765722",
"76986435499237995989855202152494490485",
"334052803025408930601094952886512345830",
"147618893471621612264698609023575684572",
"242279810063775718309552697369348077959"
],
"threshold": 0.9
},
"deprecated": false
},
{
"id": "CVE-2025-38694-996aab44",
"target": {
"function": "dib7090p_rw_on_apb",
"file": "drivers/media/dvb-frontends/dib7000p.c"
},
"signature_version": "v1",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bc07cae4f36bb18d5b6a9ed835c1278ca44ec82e",
"digest": {
"length": 410.0,
"function_hash": "107811926567043512889569427340964422984"
},
"deprecated": false
},
{
"id": "CVE-2025-38694-9e0b7f33",
"target": {
"file": "drivers/media/dvb-frontends/dib7000p.c"
},
"signature_version": "v1",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0bb32863426afe0badac25c28d59021f211d0f48",
"digest": {
"line_hashes": [
"338696589541243122575772254410246410691",
"276380789820911263275458768670038765722",
"76986435499237995989855202152494490485",
"334052803025408930601094952886512345830",
"147618893471621612264698609023575684572",
"242279810063775718309552697369348077959"
],
"threshold": 0.9
},
"deprecated": false
},
{
"id": "CVE-2025-38694-b6edd388",
"target": {
"file": "drivers/media/dvb-frontends/dib7000p.c"
},
"signature_version": "v1",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c33280d6bd668dbdc5a5f07887cc63a52ab4789c",
"digest": {
"line_hashes": [
"338696589541243122575772254410246410691",
"276380789820911263275458768670038765722",
"76986435499237995989855202152494490485",
"334052803025408930601094952886512345830",
"147618893471621612264698609023575684572",
"242279810063775718309552697369348077959"
],
"threshold": 0.9
},
"deprecated": false
},
{
"id": "CVE-2025-38694-c74adb7b",
"target": {
"file": "drivers/media/dvb-frontends/dib7000p.c"
},
"signature_version": "v1",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bc07cae4f36bb18d5b6a9ed835c1278ca44ec82e",
"digest": {
"line_hashes": [
"338696589541243122575772254410246410691",
"276380789820911263275458768670038765722",
"76986435499237995989855202152494490485",
"334052803025408930601094952886512345830",
"147618893471621612264698609023575684572",
"242279810063775718309552697369348077959"
],
"threshold": 0.9
},
"deprecated": false
},
{
"id": "CVE-2025-38694-d5064a3c",
"target": {
"file": "drivers/media/dvb-frontends/dib7000p.c"
},
"signature_version": "v1",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@19eb5d8e6aa1169d368a4d69aae5572950deb89d",
"digest": {
"line_hashes": [
"338696589541243122575772254410246410691",
"276380789820911263275458768670038765722",
"76986435499237995989855202152494490485",
"334052803025408930601094952886512345830",
"147618893471621612264698609023575684572",
"242279810063775718309552697369348077959"
],
"threshold": 0.9
},
"deprecated": false
},
{
"id": "CVE-2025-38694-e31c9469",
"target": {
"function": "dib7090p_rw_on_apb",
"file": "drivers/media/dvb-frontends/dib7000p.c"
},
"signature_version": "v1",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c33280d6bd668dbdc5a5f07887cc63a52ab4789c",
"digest": {
"length": 410.0,
"function_hash": "107811926567043512889569427340964422984"
},
"deprecated": false
},
{
"id": "CVE-2025-38694-e7dc0d35",
"target": {
"function": "dib7090p_rw_on_apb",
"file": "drivers/media/dvb-frontends/dib7000p.c"
},
"signature_version": "v1",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@09906650484a09b3a4d4b3d3065395856810becd",
"digest": {
"length": 410.0,
"function_hash": "107811926567043512889569427340964422984"
},
"deprecated": false
}
]