CVE-2023-53458: media: cx23885: Fix a null-ptr-deref bug in buffer_prepare() and buffer_finish()

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-10-01 · updated 2026-06-17
Weakness: CWE-476

Description

In the Linux kernel, the following vulnerability has been resolved: media: cx23885: Fix a null-ptr-deref bug in buffer_prepare() and buffer_finish() When the driver calls cx23885_risc_buffer() to prepare the buffer, the function call dma_alloc_coherent may fail, resulting in a empty buffer risc->cpu. Later when we free the buffer or access the buffer, null ptr deref is triggered. This bug is similar to the following one: https://git.linuxtv.org/media_stage.git/commit/?id=2b064d91440b33fba5b452f2d1b31f13ae911d71. We believe the bug can be also dynamically triggered from user side. Similarly, we fix this by checking the return value of cx23885_risc_buffer() and the value of risc->cpu before buffer free.

Affected products

Linux kernel: from 3.18 before 5.15.113; from 5.16 before 6.1.30; from 6.2 before 6.3.4 — fixed in 5.15.113, 6.1.30, 6.3.4

How to fix

Upgrade to a fixed version: Linux kernel 5.15.113, 6.1.30, 6.3.4. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-53458 or the next vulnerability affects your stack