---
id: CVE-2023-53458
title: >-
  media: cx23885: Fix a null-ptr-deref bug in buffer_prepare() and
  buffer_finish()
summary: >-
  In the Linux kernel, the following vulnerability has been resolved:


  media: cx23885: Fix a null-ptr-deref bug in buffer_prepare() and
  buffer_finish()


  When the driver calls cx23885_risc_buffer() to prepare the buffer, the

  function call d…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 4d63a25c4523b5d18e5307897d56aff785f43bf5 <
    f0a06203f2fe63f04311467200c99c4ee1926578
  - >-
    Linux >= 4d63a25c4523b5d18e5307897d56aff785f43bf5 <
    6738841f6fcf23e9fc30e2449f32fc84ee19c6f1
  - >-
    Linux >= 4d63a25c4523b5d18e5307897d56aff785f43bf5 <
    5b8e5e28e85a546dfccc3895befe0e823fdd7c89
  - >-
    Linux >= 4d63a25c4523b5d18e5307897d56aff785f43bf5 <
    47e8b73bc35d7c54642f78e498697692f6358996
  - Linux 3.18
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-05T20:21:18.770725Z'
published: '2025-10-01'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T20:31:09.961Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2023-53458'
references:
  - url: 'https://git.kernel.org/stable/c/f0a06203f2fe63f04311467200c99c4ee1926578'
  - url: 'https://git.kernel.org/stable/c/6738841f6fcf23e9fc30e2449f32fc84ee19c6f1'
  - url: 'https://git.kernel.org/stable/c/5b8e5e28e85a546dfccc3895befe0e823fdd7c89'
  - url: 'https://git.kernel.org/stable/c/47e8b73bc35d7c54642f78e498697692f6358996'
tags:
  - cve.org
epss: 0.00166
epssPercentile: 0.05899
ingestedAt: '2026-11-05T22:38:31.797Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

media: cx23885: Fix a null-ptr-deref bug in buffer_prepare() and buffer_finish()

When the driver calls cx23885_risc_buffer() to prepare the buffer, the
function call dma_alloc_coherent may fail, resulting in a empty buffer
risc->cpu. Later when we free the buffer or access the buffer, null ptr
deref is triggered.

This bug is similar to the following one:
https://git.linuxtv.org/media_stage.git/commit/?id=2b064d91440b33fba5b452f2d1b31f13ae911d71.

We believe the bug can be also dynamically triggered from user side.
Similarly, we fix this by checking the return value of cx23885_risc_buffer()
and the value of risc->cpu before buffer free.

## Affected

- `Linux >= 4d63a25c4523b5d18e5307897d56aff785f43bf5 < f0a06203f2fe63f04311467200c99c4ee1926578`
- `Linux >= 4d63a25c4523b5d18e5307897d56aff785f43bf5 < 6738841f6fcf23e9fc30e2449f32fc84ee19c6f1`
- `Linux >= 4d63a25c4523b5d18e5307897d56aff785f43bf5 < 5b8e5e28e85a546dfccc3895befe0e823fdd7c89`
- `Linux >= 4d63a25c4523b5d18e5307897d56aff785f43bf5 < 47e8b73bc35d7c54642f78e498697692f6358996`
- `Linux 3.18`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.