CVE-2023-52844

What it actually does

Missing validation of kstrdup() return value in the vidtv PSI handling code allows a NULL pointer dereference when memory allocation fails, resulting in a kernel crash.

Why it matters to the business

Systems running affected Linux kernels may experience unexpected crashes or denial of service when the vidtv media driver is exercised, increasing operational downtime risk for media or embedded deployments.

How an attack unfolds

An attacker with local access triggers the vidtv PSI code path that performs an unchecked kstrdup allocation; when allocation fails the subsequent dereference of the NULL result crashes the kernel.

How to fix it

Update the Linux kernel to a version containing commit 3387490c89b10aeb4e71d78b65dbc9ba4b2385b9 which adds the missing kstrdup return-value check.

How to confirm the fix worked

Verify the presence of the kstrdup error check in the vidtv PSI source after applying the referenced commit, or confirm the running kernel includes the fix via version or git commit inspection.

Typical attack path

1. Obtain local access to a system running an affected kernel
2. Exercise or cause the vidtv PSI allocation path to be reached
3. Force a memory allocation failure for the kstrdup call
4. Trigger NULL pointer dereference leading to kernel panic

How to detect it

Review kernel logs for oops or panic traces referencing vidtv or PSI functions; no public exploitation artifacts are known.

What your security team should do

• Apply the kernel update containing commit 3387490c89b10aeb4e71d78b65dbc9ba4b2385b9 on all affected systems
• Prioritize patching for media-processing or embedded Linux workloads
• Monitor for kernel oops or panic events in vidtv-related code paths until patches are deployed