CVE-2025-38694

What it actually does

Null pointer dereference in dib7090p_rw_on_apb when user-supplied I2C message buffers are null while length fields allow access to buf[2], buf[0], or buf[1] without prior validation.

Why it matters to the business

Local denial-of-service on affected Linux systems using the dib7090p DVB frontend; systems handling media or broadcast hardware may experience kernel crashes and service interruption.

How an attack unfolds

A local attacker crafts I2C transfer messages with zero-length null buffers and invokes the dib7090p driver through the DVB frontend interface; missing length checks allow direct dereference of the null pointers, triggering a kernel panic.

How to fix it

Update the Linux kernel to a version containing commit bc07cae4f36bb18d5b6a9ed835c1278ca44ec82e or later; rebuild and deploy the fixed dib7090p driver. For package-based distributions apply the listed fixed versions such as 8.0.43-r0 equivalents where applicable.

How to confirm the fix worked

Confirm the running kernel contains bc07cae4f36bb18d5b6a9ed835c1278ca44ec82e; attempt to reproduce the original null-buffer conditions in a test harness and verify the added length checks prevent the dereference.

Typical attack path

1. Obtain local user access on a system exposing the dib7090p DVB frontend
2. Prepare malicious i2c_msg structures with msg[0].buf = NULL and msg[0].len = 0 (or equivalent for msg[1])
3. Invoke the driver's rw_on_apb path via the DVB subsystem ioctl or equivalent userspace API
4. Trigger kernel oops/panic from the unchecked buffer access

How to detect it

Search kernel logs (dmesg, /var/log/kern.log, journalctl) for oops/panic traces containing dib7090p_rw_on_apb and references to null pointer dereference in media/dvb-frontends; correlate with recent local process activity invoking DVB ioctls.

• dib7090p_rw_on_apb
• msg[0].buf is null
• null-ptr-deref in dib7090p

What your security team should do

• Prioritize kernel upgrade on any host exposing DVB or media frontends
• Restrict unprivileged local access to DVB device nodes until patched
• Monitor for kernel oops reports referencing dib7090p_rw_on_apb
• Apply the fix within standard maintenance windows given the local attack vector