In the Linux kernel, the following vulnerability has been resolved: media: cx88: Fix a null-ptr-deref bug in buffer_prepare() When the driver calls cx88_risc_buffer() to prepare the buffer, the function call may fail, resulting in a empty buffer and null-ptr-deref later in buffer_queue(). The following log can reveal it: [ 41.822762] general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN PTI [ 41.824488] KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] [ 41.828027] RIP: 0010:buffer_queue+0xc2/0x500 [ 41.836311] Call Trace: [ 41.836945] __enqueue_in_driver+0x141/0x360 [ 41.837262] vb2_start_streaming+0x62/0x4a0 [ 41.838216] vb2_core_streamon+0x1da/0x2c0 [ 41.838516] __vb2_init_fileio+0x981/0xbc0 [ 41.839141] __vb2_perform_fileio+0xbf9/0x1120 [ 41.840072] vb2_fop_read+0x20e/0x400 [ 41.840346] v4l2_read+0x215/0x290 [ 41.840603] vfs_read+0x162/0x4c0 Fix this by checking the return value of cx88_risc_buffer() [hverkuil: fix coding style issues]

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Affected Vendors & Products

Vendors Products
Linux
  • Linux Kernel

No data.

No data.

References
Link Providers
https://git.kernel.org/stable/c/10c99d1c46ea9cd940029e17bab11d021f315c21 cve-icon cve-icon
https://git.kernel.org/stable/c/2b064d91440b33fba5b452f2d1b31f13ae911d71 cve-icon cve-icon
https://git.kernel.org/stable/c/4befc7ffa18ef9a4b70d854465313a345a06862f cve-icon cve-icon
https://git.kernel.org/stable/c/644d5a87ab1863eb606526ea743021752a17e9cb cve-icon cve-icon
https://git.kernel.org/stable/c/6f21976095c1e92454ab030976f95f40d652351b cve-icon cve-icon
https://git.kernel.org/stable/c/704838040f3bdb4aa07ff4f26505a666a3defcfe cve-icon cve-icon
https://git.kernel.org/stable/c/9181af2dbf06e7f432e5dbe88d10b22343e851b9 cve-icon cve-icon
https://git.kernel.org/stable/c/c2257c8a501537afab276c306cb717b7260276e1 cve-icon cve-icon
https://git.kernel.org/stable/c/c76d04d2079a4b7369ce9a0e859c0f3f2250bcc1 cve-icon cve-icon
https://lore.kernel.org/linux-cve-announce/2025091714-CVE-2022-50359-e9fb@gregkh/T cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2022-50359 cve-icon
https://www.cve.org/CVERecord?id=CVE-2022-50359 cve-icon
History

Thu, 18 Sep 2025 12:45:00 +0000

Type Values Removed Values Added
First Time appeared Linux
Linux linux Kernel
Vendors & Products Linux
Linux linux Kernel

Thu, 18 Sep 2025 00:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 cvssV3_1

{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}

threat_severity

Moderate

Wed, 17 Sep 2025 15:00:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: media: cx88: Fix a null-ptr-deref bug in buffer_prepare() When the driver calls cx88_risc_buffer() to prepare the buffer, the function call may fail, resulting in a empty buffer and null-ptr-deref later in buffer_queue(). The following log can reveal it: [ 41.822762] general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN PTI [ 41.824488] KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] [ 41.828027] RIP: 0010:buffer_queue+0xc2/0x500 [ 41.836311] Call Trace: [ 41.836945] __enqueue_in_driver+0x141/0x360 [ 41.837262] vb2_start_streaming+0x62/0x4a0 [ 41.838216] vb2_core_streamon+0x1da/0x2c0 [ 41.838516] __vb2_init_fileio+0x981/0xbc0 [ 41.839141] __vb2_perform_fileio+0xbf9/0x1120 [ 41.840072] vb2_fop_read+0x20e/0x400 [ 41.840346] v4l2_read+0x215/0x290 [ 41.840603] vfs_read+0x162/0x4c0 Fix this by checking the return value of cx88_risc_buffer() [hverkuil: fix coding style issues]
Title media: cx88: Fix a null-ptr-deref bug in buffer_prepare()
References
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2025-09-17T14:56:11.482Z

Updated: 2025-09-17T14:56:11.482Z

Reserved: 2025-09-17T14:53:06.994Z

Link: CVE-2022-50359

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2025-09-17T15:15:34.633

Modified: 2025-09-18T13:43:34.310

Link: CVE-2022-50359

cve-icon Redhat

Severity : Moderate

Publid Date: 2025-09-17T00:00:00Z

Links: CVE-2022-50359 - Bugzilla