CVE-2023-53244: media: pci: tw68: Fix null-ptr-deref bug in buf prepare and finish

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-09-15 · updated 2026-06-17
Weakness: CWE-476

Description

In the Linux kernel, the following vulnerability has been resolved: media: pci: tw68: Fix null-ptr-deref bug in buf prepare and finish When the driver calls tw68_risc_buffer() to prepare the buffer, the function call dma_alloc_coherent may fail, resulting in a empty buffer buf->cpu. Later when we free the buffer or access the buffer, null ptr deref is triggered. This bug is similar to the following one: https://git.linuxtv.org/media_stage.git/commit/?id=2b064d91440b33fba5b452f2d1b31f13ae911d71. We believe the bug can be also dynamically triggered from user side. Similarly, we fix this by checking the return value of tw68_risc_buffer() and the value of buf->cpu before buffer free.

Affected products

Linux kernel: before 5.15.113; from 5.16 before 6.1.30; from 6.2 before 6.3.4 — fixed in 5.15.113, 6.1.30, 6.3.4

How to fix

Upgrade to a fixed version: Linux kernel 5.15.113, 6.1.30, 6.3.4. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-53244 or the next vulnerability affects your stack