{"id":"CVE-2023-53458","title":"media: cx23885: Fix a null-ptr-deref bug in buffer_prepare() and buffer_finish()","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: cx23885: Fix a null-ptr-deref bug in buffer_prepare() and buffer_finish()\n\nWhen the driver calls cx23885_risc_buffer() to prepare the buffer, the\nfunction call d…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 4d63a25c4523b5d18e5307897d56aff785f43bf5 < f0a06203f2fe63f04311467200c99c4ee1926578","Linux >= 4d63a25c4523b5d18e5307897d56aff785f43bf5 < 6738841f6fcf23e9fc30e2449f32fc84ee19c6f1","Linux >= 4d63a25c4523b5d18e5307897d56aff785f43bf5 < 5b8e5e28e85a546dfccc3895befe0e823fdd7c89","Linux >= 4d63a25c4523b5d18e5307897d56aff785f43bf5 < 47e8b73bc35d7c54642f78e498697692f6358996","Linux 3.18"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-05T20:21:18.770725Z"},"published":"2025-10-01","updated":"2026-11-05","sourceUpdated":"2026-11-05T20:31:09.961Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2023-53458","references":[{"url":"https://git.kernel.org/stable/c/f0a06203f2fe63f04311467200c99c4ee1926578"},{"url":"https://git.kernel.org/stable/c/6738841f6fcf23e9fc30e2449f32fc84ee19c6f1"},{"url":"https://git.kernel.org/stable/c/5b8e5e28e85a546dfccc3895befe0e823fdd7c89"},{"url":"https://git.kernel.org/stable/c/47e8b73bc35d7c54642f78e498697692f6358996"}],"tags":["cve.org"],"epss":0.00166,"epssPercentile":0.05899,"ingestedAt":"2026-11-05T22:38:31.797Z","slug":"CVE-2023-53458","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmedia: cx23885: Fix a null-ptr-deref bug in buffer_prepare() and buffer_finish()\n\nWhen the driver calls cx23885_risc_buffer() to prepare the buffer, the\nfunction call dma_alloc_coherent may fail, resulting in a empty buffer\nrisc->cpu. Later when we free the buffer or access the buffer, null ptr\nderef is triggered.\n\nThis bug is similar to the following one:\nhttps://git.linuxtv.org/media_stage.git/commit/?id=2b064d91440b33fba5b452f2d1b31f13ae911d71.\n\nWe believe the bug can be also dynamically triggered from user side.\nSimilarly, we fix this by checking the return value of cx23885_risc_buffer()\nand the value of risc->cpu before buffer free.\n\n## Affected\n\n- `Linux >= 4d63a25c4523b5d18e5307897d56aff785f43bf5 < f0a06203f2fe63f04311467200c99c4ee1926578`\n- `Linux >= 4d63a25c4523b5d18e5307897d56aff785f43bf5 < 6738841f6fcf23e9fc30e2449f32fc84ee19c6f1`\n- `Linux >= 4d63a25c4523b5d18e5307897d56aff785f43bf5 < 5b8e5e28e85a546dfccc3895befe0e823fdd7c89`\n- `Linux >= 4d63a25c4523b5d18e5307897d56aff785f43bf5 < 47e8b73bc35d7c54642f78e498697692f6358996`\n- `Linux 3.18`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}