{"id":"CVE-2025-38693","title":"media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and w7090p_tuner_read_serpar","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and w7090p_tuner_read_serpar\n\nIn w7090p_tuner_write_serpar, msg is controlled by user. Whe…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 713d54a8bd812229410a1902cd9b332a2a27af9f < 7a41ecfc3415ebe3b4c44f96b3337691dcf431a3","Linux >= 713d54a8bd812229410a1902cd9b332a2a27af9f < b3d77a3fc71c084575d3df4ec6544b3fb6ce587d","Linux >= 713d54a8bd812229410a1902cd9b332a2a27af9f < 17b30e5ded062bd74f8ca6f317e1d415a8680665","Linux >= 713d54a8bd812229410a1902cd9b332a2a27af9f < 454a443eaa792c8865c861a282fe6d4f596abc3a","Linux >= 713d54a8bd812229410a1902cd9b332a2a27af9f < 6bbaec6a036940e22318f0454b50b8000845ab59","Linux >= 713d54a8bd812229410a1902cd9b332a2a27af9f < f98132a59ccc59a8b97987363bc99c8968934756","Linux >= 713d54a8bd812229410a1902cd9b332a2a27af9f < 99690a494d91a0dc86cebd628da4c62c40552bcb","Linux >= 713d54a8bd812229410a1902cd9b332a2a27af9f < 39b06b93f24dff923c4183d564ed28c039150554","Linux >= 713d54a8bd812229410a1902cd9b332a2a27af9f < ed0234c8458b3149f15e496b48a1c9874dd24a1b","Linux 2.6.39"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-05T21:07:25.918570Z"},"published":"2025-09-04","updated":"2026-11-05","sourceUpdated":"2026-11-05T21:12:53.217Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-38693","references":[{"url":"https://git.kernel.org/stable/c/7a41ecfc3415ebe3b4c44f96b3337691dcf431a3"},{"url":"https://git.kernel.org/stable/c/b3d77a3fc71c084575d3df4ec6544b3fb6ce587d"},{"url":"https://git.kernel.org/stable/c/17b30e5ded062bd74f8ca6f317e1d415a8680665"},{"url":"https://git.kernel.org/stable/c/454a443eaa792c8865c861a282fe6d4f596abc3a"},{"url":"https://git.kernel.org/stable/c/6bbaec6a036940e22318f0454b50b8000845ab59"},{"url":"https://git.kernel.org/stable/c/f98132a59ccc59a8b97987363bc99c8968934756"},{"url":"https://git.kernel.org/stable/c/99690a494d91a0dc86cebd628da4c62c40552bcb"},{"url":"https://git.kernel.org/stable/c/39b06b93f24dff923c4183d564ed28c039150554"},{"url":"https://git.kernel.org/stable/c/ed0234c8458b3149f15e496b48a1c9874dd24a1b"}],"tags":["cve.org"],"epss":0.00183,"epssPercentile":0.07932,"ingestedAt":"2026-11-05T22:38:32.022Z","slug":"CVE-2025-38693","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmedia: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and w7090p_tuner_read_serpar\n\nIn w7090p_tuner_write_serpar, msg is controlled by user. When msg[0].buf is null and msg[0].len is zero, former checks on msg[0].buf would be passed. If accessing msg[0].buf[2] without sanity check, null pointer deref would happen. We add\ncheck on msg[0].len to prevent crash.\n\nSimilar commit: commit 0ed554fd769a (\"media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()\")\n\n## Affected\n\n- `Linux >= 713d54a8bd812229410a1902cd9b332a2a27af9f < 7a41ecfc3415ebe3b4c44f96b3337691dcf431a3`\n- `Linux >= 713d54a8bd812229410a1902cd9b332a2a27af9f < b3d77a3fc71c084575d3df4ec6544b3fb6ce587d`\n- `Linux >= 713d54a8bd812229410a1902cd9b332a2a27af9f < 17b30e5ded062bd74f8ca6f317e1d415a8680665`\n- `Linux >= 713d54a8bd812229410a1902cd9b332a2a27af9f < 454a443eaa792c8865c861a282fe6d4f596abc3a`\n- `Linux >= 713d54a8bd812229410a1902cd9b332a2a27af9f < 6bbaec6a036940e22318f0454b50b8000845ab59`\n- `Linux >= 713d54a8bd812229410a1902cd9b332a2a27af9f < f98132a59ccc59a8b97987363bc99c8968934756`\n- `Linux >= 713d54a8bd812229410a1902cd9b332a2a27af9f < 99690a494d91a0dc86cebd628da4c62c40552bcb`\n- `Linux >= 713d54a8bd812229410a1902cd9b332a2a27af9f < 39b06b93f24dff923c4183d564ed28c039150554`\n- `Linux >= 713d54a8bd812229410a1902cd9b332a2a27af9f < ed0234c8458b3149f15e496b48a1c9874dd24a1b`\n- `Linux 2.6.39`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}