Skip to main content

Linux Kernel CVE-2025-68819

HIGH
2026-01-13 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Buffer Overflow Linux Red Hat Suse
7.8
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.8 HIGH

Local trigger via the driver's I2C path (AV:L) needs low local privileges (PR:L); kernel memory corruption yields high C/I/A with no scope change.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
6.1 MEDIUM
qualitative

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

7
Analysis Updated
Jul 30, 2026 - 07:04 vuln.today
v3 (cvss_changed)
Analysis Updated
Jul 30, 2026 - 07:01 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Jul 30, 2026 - 06:37 vuln.today
cvss_changed
CVSS changed
Jul 30, 2026 - 06:37 NVD
7.8 (HIGH)
Patch released
Mar 16, 2026 - 15:00 nvd
Patch available
Analysis Generated
Mar 12, 2026 - 21:54 vuln.today
CVE Published
Jan 13, 2026 - 16:16 nvd
N/A

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

media: dvb-usb: dtv5100: fix out-of-bounds in dtv5100_i2c_msg()

rlen value is a user-controlled value, but dtv5100_i2c_msg() does not check the size of the rlen value. Therefore, if it is set to a value larger than sizeof(st->data), an out-of-bounds vuln occurs for st->data.

Therefore, we need to add proper range checking to prevent this vuln.

AnalysisAI

Out-of-bounds memory access in the Linux kernel's dtv5100 DVB-USB media driver allows a local, low-privileged attacker to corrupt kernel memory via an unchecked, user-controlled rlen value in dtv5100_i2c_msg(). Because rlen is never validated against sizeof(st->data), a value larger than the buffer drives reads/writes past the allocated region, enabling denial of service and potential local privilege escalation. There is no public exploit identified at time of analysis, EPSS is very low (0.05%), and it is not listed in CISA KEV, but a vendor fix is available.

Technical ContextAI

The flaw lives in the dvb-usb subsystem's dtv5100 driver, which supports a niche USB DVB-T TV tuner. The driver exposes an I2C message helper, dtv5100_i2c_msg(), that copies data into a fixed-size per-device buffer (st->data). The read-length parameter (rlen) is attacker-influenced but is used to size the transfer without any bounds check against the destination buffer, so oversized values overflow st->data. This is a classic out-of-bounds / buffer overflow (matching the supplied 'Buffer Overflow' tag; the CWE field is N/A in the source data, but the root cause maps to the CWE-787/CWE-125 class of missing length validation on a fixed buffer). The affected code path only becomes reachable when this specific DVB-USB driver module is present and the corresponding hardware or I2C interface is exercised.

Affected ProductsAI

The Linux kernel is affected via the drivers/media/usb/dvb-usb/dtv5100 driver; multiple stable branches are impacted, as evidenced by the seven separate stable-tree fix commits on git.kernel.org (4a54d8fc, 61f214a8, ac92151f, b91e6aaf, c2305b4c, c2c293ea, fe3e129a), indicating backports across several longterm/stable series. Distribution exposure is confirmed for Ubuntu, which addresses it in advisory USN-8096-1 (https://ubuntu.com/security/notices/USN-8096-1); a secondary tracking entry exists at VulDB (https://vuldb.com/vuln/340680). No specific upstream mainline version string is provided in the source data, so exact fixed release numbers should be taken from each distribution's advisory rather than inferred.

RemediationAI

Vendor-released patch: apply the upstream kernel fix that adds proper range checking of rlen against sizeof(st->data) in dtv5100_i2c_msg(), delivered via the stable commits listed on git.kernel.org (e.g. 4a54d8fcb093, 61f214a878e9, and the other backports). Ubuntu users should update to the fixed kernel packages per USN-8096-1 (https://ubuntu.com/security/notices/USN-8096-1) and reboot into the patched kernel; other distributions should apply their equivalent kernel security update. As a compensating control where patching is delayed, prevent the vulnerable code from loading by blacklisting the dtv5100 module (e.g. add 'blacklist dtv5100' or 'install dtv5100 /bin/true' in modprobe config) and restricting physical/local USB access so the DVB-USB tuner cannot be attached; the trade-off is loss of support for that specific TV-tuner device, which is acceptable on the overwhelming majority of servers and workstations that never use it.

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Container suse/sl-micro/6.0/baremetal-os-container:latest Container suse/sl-micro/6.0/toolbox:latest Affected
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.95 Image SL-Micro Image SLE-Micro Image SLE-Micro-Azure Image SLE-Micro-BYOS Image SLE-Micro-BYOS-Azure Image SLE-Micro-BYOS-EC2 Image SLE-Micro-BYOS-GCE Image SLE-Micro-EC2 Image SLE-Micro-GCE Affected
Container suse/sl-micro/6.0/kvm-os-container:2.1.3-6.115 Affected
Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.146 Affected
Container suse/sl-micro/6.1/base-os-container:2.2.1-5.80 Image SL-Micro-Azure Image SL-Micro-BYOS-Azure Image SL-Micro-BYOS-EC2 Image SL-Micro-BYOS-GCE Image SL-Micro-EC2 Image SUSE-Multi-Linux-Manager-Proxy-BYOS-Azure Image SUSE-Multi-Linux-Manager-Proxy-BYOS-EC2 Image SUSE-Multi-Linux-Manager-Proxy-BYOS-GCE Image SUSE-Multi-Linux-Manager-Server-Azure-llc Image SUSE-Multi-Linux-Manager-Server-Azure-ltd Image SUSE-Multi-Linux-Manager-Server-BYOS-Azure Image SUSE-Multi-Linux-Manager-Server-BYOS-EC2 Image SUSE-Multi-Linux-Manager-Server-BYOS-GCE Image SUSE-Multi-Linux-Manager-Server-EC2-llc Image SUSE-Multi-Linux-Manager-Server-EC2-ltd Affected

Share

CVE-2025-68819 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy