CVE-2025-68819

media: dvb-usb: dtv5100: fix out-of-bounds in dtv5100_i2c_msg()

State: Published
Severity: 7.8 High
Published: Jan 13, 2026
Updated: Oct 19, 2026
Reserved: Dec 24, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

media: dvb-usb: dtv5100: fix out-of-bounds in dtv5100_i2c_msg()

rlen value is a user-controlled value, but dtv5100_i2c_msg() does not check the size of the rlen value. Therefore, if it is set to a value larger than sizeof(st->data), an out-of-bounds vuln occurs for st->data.

Therefore, we need to add proper range checking to prevent this vuln.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

CWE-787 Out-of-bounds Write

Affected Products

Product	Versions
LinuxLinux	60688d5e6e6e2ae62f29762d1e3b2aec2dbd3817 to before c2c293ea7b61f12cdaad1e99a5b4efc58c88960aAffected 60688d5e6e6e2ae62f29762d1e3b2aec2dbd3817 to before c2305b4c5fc15e20ac06c35738e0578eb4323750Affected 60688d5e6e6e2ae62f29762d1e3b2aec2dbd3817 to before 61f214a878e96e2a8750bf96a98f78c658dba60cAffected 60688d5e6e6e2ae62f29762d1e3b2aec2dbd3817 to before 4a54d8fcb093761e4c56eb211cf4e39bf8401fa1Affected 60688d5e6e6e2ae62f29762d1e3b2aec2dbd3817 to before fe3e129ab49806aaaa3f22067ebc75c2dfbe4658Affected 60688d5e6e6e2ae62f29762d1e3b2aec2dbd3817 to before ac92151ff2494130d9fc686055d6bbb9743a673eAffected 60688d5e6e6e2ae62f29762d1e3b2aec2dbd3817 to before b91e6aafe8d356086cc621bc03e35ba2299e4788Affected
LinuxLinux	2.6.28Affected before 2.6.28Not affected 5.10.248 through 5.10.Not affected 5.15.198 through 5.15.Not affected 6.1.160 through 6.1.Not affected 6.6.120 through 6.6.Not affected 6.12.64 through 6.12.Not affected 6.18.3 through 6.18.Not affected 6.19 and laterNot affected

Product

Versions

LinuxLinux

60688d5e6e6e2ae62f29762d1e3b2aec2dbd3817 to before c2c293ea7b61f12cdaad1e99a5b4efc58c88960aAffected
60688d5e6e6e2ae62f29762d1e3b2aec2dbd3817 to before c2305b4c5fc15e20ac06c35738e0578eb4323750Affected
60688d5e6e6e2ae62f29762d1e3b2aec2dbd3817 to before 61f214a878e96e2a8750bf96a98f78c658dba60cAffected
60688d5e6e6e2ae62f29762d1e3b2aec2dbd3817 to before 4a54d8fcb093761e4c56eb211cf4e39bf8401fa1Affected
60688d5e6e6e2ae62f29762d1e3b2aec2dbd3817 to before fe3e129ab49806aaaa3f22067ebc75c2dfbe4658Affected
60688d5e6e6e2ae62f29762d1e3b2aec2dbd3817 to before ac92151ff2494130d9fc686055d6bbb9743a673eAffected
60688d5e6e6e2ae62f29762d1e3b2aec2dbd3817 to before b91e6aafe8d356086cc621bc03e35ba2299e4788Affected

LinuxLinux

2.6.28Affected
before 2.6.28Not affected
5.10.248 through 5.10.*Not affected
5.15.198 through 5.15.*Not affected
6.1.160 through 6.1.*Not affected
6.6.120 through 6.6.*Not affected
6.12.64 through 6.12.*Not affected
6.18.3 through 6.18.*Not affected
6.19 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.