---
id: CVE-2025-38693
title: >-
  media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar
  and w7090p_tuner_read_serpar
summary: >-
  In the Linux kernel, the following vulnerability has been resolved:


  media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar
  and w7090p_tuner_read_serpar


  In w7090p_tuner_write_serpar, msg is controlled by user. Whe…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 713d54a8bd812229410a1902cd9b332a2a27af9f <
    7a41ecfc3415ebe3b4c44f96b3337691dcf431a3
  - >-
    Linux >= 713d54a8bd812229410a1902cd9b332a2a27af9f <
    b3d77a3fc71c084575d3df4ec6544b3fb6ce587d
  - >-
    Linux >= 713d54a8bd812229410a1902cd9b332a2a27af9f <
    17b30e5ded062bd74f8ca6f317e1d415a8680665
  - >-
    Linux >= 713d54a8bd812229410a1902cd9b332a2a27af9f <
    454a443eaa792c8865c861a282fe6d4f596abc3a
  - >-
    Linux >= 713d54a8bd812229410a1902cd9b332a2a27af9f <
    6bbaec6a036940e22318f0454b50b8000845ab59
  - >-
    Linux >= 713d54a8bd812229410a1902cd9b332a2a27af9f <
    f98132a59ccc59a8b97987363bc99c8968934756
  - >-
    Linux >= 713d54a8bd812229410a1902cd9b332a2a27af9f <
    99690a494d91a0dc86cebd628da4c62c40552bcb
  - >-
    Linux >= 713d54a8bd812229410a1902cd9b332a2a27af9f <
    39b06b93f24dff923c4183d564ed28c039150554
  - >-
    Linux >= 713d54a8bd812229410a1902cd9b332a2a27af9f <
    ed0234c8458b3149f15e496b48a1c9874dd24a1b
  - Linux 2.6.39
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-05T21:07:25.918570Z'
published: '2025-09-04'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T21:12:53.217Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-38693'
references:
  - url: 'https://git.kernel.org/stable/c/7a41ecfc3415ebe3b4c44f96b3337691dcf431a3'
  - url: 'https://git.kernel.org/stable/c/b3d77a3fc71c084575d3df4ec6544b3fb6ce587d'
  - url: 'https://git.kernel.org/stable/c/17b30e5ded062bd74f8ca6f317e1d415a8680665'
  - url: 'https://git.kernel.org/stable/c/454a443eaa792c8865c861a282fe6d4f596abc3a'
  - url: 'https://git.kernel.org/stable/c/6bbaec6a036940e22318f0454b50b8000845ab59'
  - url: 'https://git.kernel.org/stable/c/f98132a59ccc59a8b97987363bc99c8968934756'
  - url: 'https://git.kernel.org/stable/c/99690a494d91a0dc86cebd628da4c62c40552bcb'
  - url: 'https://git.kernel.org/stable/c/39b06b93f24dff923c4183d564ed28c039150554'
  - url: 'https://git.kernel.org/stable/c/ed0234c8458b3149f15e496b48a1c9874dd24a1b'
tags:
  - cve.org
epss: 0.00183
epssPercentile: 0.07932
ingestedAt: '2026-11-05T22:38:32.022Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and w7090p_tuner_read_serpar

In w7090p_tuner_write_serpar, msg is controlled by user. When msg[0].buf is null and msg[0].len is zero, former checks on msg[0].buf would be passed. If accessing msg[0].buf[2] without sanity check, null pointer deref would happen. We add
check on msg[0].len to prevent crash.

Similar commit: commit 0ed554fd769a ("media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()")

## Affected

- `Linux >= 713d54a8bd812229410a1902cd9b332a2a27af9f < 7a41ecfc3415ebe3b4c44f96b3337691dcf431a3`
- `Linux >= 713d54a8bd812229410a1902cd9b332a2a27af9f < b3d77a3fc71c084575d3df4ec6544b3fb6ce587d`
- `Linux >= 713d54a8bd812229410a1902cd9b332a2a27af9f < 17b30e5ded062bd74f8ca6f317e1d415a8680665`
- `Linux >= 713d54a8bd812229410a1902cd9b332a2a27af9f < 454a443eaa792c8865c861a282fe6d4f596abc3a`
- `Linux >= 713d54a8bd812229410a1902cd9b332a2a27af9f < 6bbaec6a036940e22318f0454b50b8000845ab59`
- `Linux >= 713d54a8bd812229410a1902cd9b332a2a27af9f < f98132a59ccc59a8b97987363bc99c8968934756`
- `Linux >= 713d54a8bd812229410a1902cd9b332a2a27af9f < 99690a494d91a0dc86cebd628da4c62c40552bcb`
- `Linux >= 713d54a8bd812229410a1902cd9b332a2a27af9f < 39b06b93f24dff923c4183d564ed28c039150554`
- `Linux >= 713d54a8bd812229410a1902cd9b332a2a27af9f < ed0234c8458b3149f15e496b48a1c9874dd24a1b`
- `Linux 2.6.39`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.