CVE-2023-53220: linux kernel Null Dereference — Fix

Description

In the Linux kernel, the following vulnerability has been resolved: media: az6007: Fix null-ptr-deref in az6007_i2c_xfer() In az6007_i2c_xfer, msg is controlled by user. When msg[i].buf is null and msg[i].len is zero, former checks on msg[i].buf would be passed. Malicious data finally reach az6007_i2c_xfer. If accessing msg[i].buf[0] without sanity check, null ptr deref would happen. We add check on msg[i].len to prevent crash. Similar commit: commit 0ed554fd769a ("media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()")

Is your site exposed to CVE-2023-53220?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

5.5

MEDIUM

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness Type (CWE)

CWE-476 CWE-476

Affected Products

Vendor	Product	Versions
linux	linux_kernel	< 4.14.326
linux	linux_kernel	4.15 — 4.19.295
linux	linux_kernel	4.20 — 5.4.257
linux	linux_kernel	5.5 — 5.10.197
linux	linux_kernel	5.11 — 5.15.133
linux	linux_kernel	5.16 — 6.1.55
linux	linux_kernel	6.2 — 6.5.5

References

Advisories & Patches

https://git.kernel.org/stable/c/1047f9343011f2cedc73c64829686206a7e9fc3f https://git.kernel.org/stable/c/5b1ea100ad3695025969dc4693f307877fb688d6 https://git.kernel.org/stable/c/6ab7ea4e17d6a605d05308adf8f3408924770cba https://git.kernel.org/stable/c/991c77fe18c6f374bbf83376f8c42550aa565662 https://git.kernel.org/stable/c/a1110f19d4940e4185251d072cbb0ff51486a1e7 https://git.kernel.org/stable/c/a9def3e9718a4dc756f48db147d42ec41a966240 https://git.kernel.org/stable/c/adcb73f8ce9aec48b1f85223f401c1574015d8d2 https://git.kernel.org/stable/c/c6763fefa267f6e62595a6ac1f57815d99fc90b7

Frequently Asked Questions

What is CVE-2023-53220? +

In the Linux kernel, the following vulnerability has been resolved: media: az6007: Fix null-ptr-deref in az6007_i2c_xfer() In az6007_i2c_xfer, msg is controlled by user. When msg[i].buf is null and msg[i].len is zero, former checks on msg[i].buf would be passed. Malicious data finally reach az6007_i2c_xfer. If accessing msg[i].buf[0] without sanity check, null ptr deref would happen. We add check on msg[i].len to prevent crash. Similar commit: commit 0ed554fd769a ("media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()") It has a CVSS v3.1 base score of 5.5 (MEDIUM).

How severe is CVE-2023-53220? +

CVE-2023-53220 has a CVSS v3.1 score of 5.5 out of 10, rated MEDIUM. This is a medium-severity vulnerability that should be remediated as part of regular maintenance.

What products are affected by CVE-2023-53220? +

CVE-2023-53220 affects products from linux, specifically: linux_kernel. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2023-53220? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2026-8479

IEC 60870-5-104 used in bidirectional mode in RTU500 is vulnerable for a NULL pointer dereferencing, if a specially crafted sequence …

CVE-2025-24031

PAM-PKCS#11 is a Linux-PAM login module that allows a X.509 certificate based user login. In versions 0.6.12 and prior, the …

CVE-2025-31115

XZ Utils provide a general-purpose data-compression library plus command-line tools. In XZ Utils 5.3.3alpha to 5.8.0, the multithreaded .xz decoder …

CVE-2025-0121

A null pointer dereference vulnerability in the Palo Alto Networks Cortex® XDR agent on Windows devices allows a low-privileged local …

CVE-2023-45925

GNU Midnight Commander 4.8.29-146-g299d9a2fb was discovered to contain a NULL pointer dereference via the function x_error_handler() at tty/x11conn.c. NOTE: this …

CVE-2025-6398

A null pointer dereference vulnerability exists in the IOMap64.sys driver of ASUS AI Suite 3. The vulnerability can be triggered …

CVE-2023-53220