CVE-2025-38693

What it actually does

Null pointer dereference in w7090p_tuner_write_serpar and w7090p_tuner_read_serpar when user-controlled I2C message has null buf and zero length, bypassing prior checks and accessing msg[0].buf[2].

Why it matters to the business

Local denial of service on Linux systems using the w7090p DVB frontend, causing kernel crashes that disrupt media or broadcast hardware operations.

How an attack unfolds

Local attacker interacts with the DVB driver via I2C transfers, supplying a crafted msg array with null buffer and zero length to reach the unchecked buf access in the tuner serpar functions and trigger a kernel panic.

How to fix it

Update the Linux kernel to the commit 7a41ecfc3415ebe3b4c44f96b3337691dcf431a3 or later versions that add the missing msg[0].len sanity check.

How to confirm the fix worked

Verify the presence of the len check before buf access in w7090p_tuner_write_serpar and w7090p_tuner_read_serpar; test with crafted zero-length null-buffer I2C messages to confirm no crash occurs.

Typical attack path

1. Obtain local user access on an affected Linux system
2. Load or trigger the dvb-frontends w7090p driver
3. Craft and submit an I2C message with msg[0].buf set to null and msg[0].len set to zero
4. Invoke w7090p_tuner_write_serpar or w7090p_tuner_read_serpar to cause the dereference

How to detect it

Inspect kernel ring buffer and dmesg for null pointer dereference oops mentioning w7090p_tuner_write_serpar or w7090p_tuner_read_serpar; correlate with I2C or DVB frontend activity timestamps.

• w7090p_tuner_write_serpar
• w7090p_tuner_read_serpar
• msg[0].buf is null
• Unable to handle kernel NULL pointer dereference
• RIP: w7090p_tuner

What your security team should do

• Apply the referenced kernel commit immediately on systems exposing DVB hardware
• Restrict local access to media-related device nodes where feasible
• Monitor kernel logs for w7090p-related oops after any media driver activity