CVE-2023-28328

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-04-19 · updated 2026-06-17
Weakness: CWE-476

Description

A NULL pointer dereference flaw was found in the az6027 driver in drivers/media/usb/dev-usb/az6027.c in the Linux Kernel. The message from user space is not checked properly before transferring into the device. This flaw allows a local user to crash the system or potentially cause a denial of service.

Affected products

Linux kernel: before 6.2 — fixed in 6.2
Red Hat Enterprise Linux: 8.0

How to fix

Upgrade to a fixed version: Linux kernel 6.2. Check the vendor advisory for mitigations.

References

https://bugzilla.redhat.com/show_bug.cgi?id=2177389
https://lists.debian.org/debian-lts-announce/2023/05/msg00005.html
https://lists.debian.org/debian-lts-announce/2023/05/msg00006.html
https://bugzilla.redhat.com/show_bug.cgi?id=2177389
https://lists.debian.org/debian-lts-announce/2023/05/msg00005.html
https://lists.debian.org/debian-lts-announce/2023/05/msg00006.html

Get alerted when CVE-2023-28328 or the next vulnerability affects your stack