CVE-2025-68819

Vulnerability

In the Linux kernel's media: dvb-usb subsystem, the dtv5100_i2c_msg() function in the dtv5100 driver lacks a bounds check on the user-controlled rlen value. When rlen is larger than the allocated buffer st->data, an out-of-bounds write occurs, corrupting adjacent memory [1][2][3].

Exploitation

The out-of-bounds condition is triggered by a malicious USB device that sends a crafted I2C message with an oversized rlen. The attacker requires physical access or the ability to inject a malicious USB device. No authentication is needed beyond device connection.

Impact

A successful exploit allows overwriting kernel memory beyond the intended buffer, potentially leading to denial of service or arbitrary code execution with kernel privileges.

Mitigation

The vulnerability is fixed by adding proper size validation in the affected driver. Patches have been applied to stable kernel trees [1][2][3]. Users should update to a patched kernel version.