Loading story…
CVE-2023-28328 affects the Linux kernel's AZ6027 USB DVB media-driver I2C transfer routine, az6027_i2c_xfer(). A local low-privileged user can submit a crafted I2C message—such as address 0x99 with zero length and a NULL buffer—causing the driver to dereference msg[i].buf[0] and crash the kernel. The defect was found through kernel fuzzing, which reproduced a KASAN-detected general-protection fault through the I2C_RDWR ioctl path.
The upstream fix validates that the I2C message length is at least one before accessing its buffer and returns -EOPNOTSUPP for invalid requests. Red Hat rated the issue Moderate with CVSS 3.1 score 5.5, released fixes for affected RHEL 8 kernel streams, and stated that RHEL 9 is unaffected. Until patched, administrators can reduce exposure by blacklisting the dvb_usb_az6027 kernel module where the associated hardware is not required.
See affected versions and whether adversaries are exploiting it.
5 events from the most recent confirmed update back to the earliest known activity.
Red Hat released fixes for affected Red Hat Enterprise Linux 8 kernel and kernel-rt streams through RHSA-2023:7077 and RHSA-2023:6901. The flaw allows a local low-privileged user to crash the system through a NULL pointer dereference in the az6027 driver.
Baisong Zhong submitted a patch to reject zero-length I2C messages before az6027_i2c_xfer accesses msg[i].buf[0]. The proposed fix returns -EOPNOTSUPP for the invalid message condition reported by Wei Chen.
Wei Chen reported a reproducible general-protection fault and KASAN-detected null-pointer dereference in the Linux AZ6027 USB DVB driver's az6027_i2c_xfer function. The issue was reachable through the I2C_RDWR ioctl path and persisted in upstream Linux v6.1-rc5.
Red Hat released RHSA-2024:0724 to fix CVE-2023-28328 for Red Hat Enterprise Linux 8.6 Extended Update Support and Red Hat Virtualization 4 for RHEL 8.
Red Hat released RHSA-2024:0575 to address CVE-2023-28328 for Red Hat Enterprise Linux 8.8 Extended Update Support.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
redhat.com
Open sourcelore.kernel.org
Open sourcelore.kernel.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**CVE-2022-41218** is a medium-severity use-after-free flaw in the Linux kernel's `dvb-core` subsystem, affecting Digital Video Broadcasting devices. A local low-privileged attacker could race malicious code against removal of a USB DVB demultiplexer or similar device, causing freed memory in `drivers/media/dvb-core/dmxdev.c` to be accessed. Successful exploitation could crash the host or potentially elevate privileges, although Red Hat rated the issue CVSS 5.5 because physical device removal and a difficult-to-win race condition are required. Kernel developers identified related DVB frontend, network, and device-registration races involving concurrent open, close, and USB-disconnect operations; KASAN reproduced the use-after-free conditions on Linux 6.1.0-rc2 and later. Fedora shipped a fix in kernel 6.0.18 stable updates, while Red Hat remediated affected RHEL 8 `kernel` and `kernel-rt` packages through RHSA-2023:2736 and RHSA-2023:2951, with subsequent coverage for RHEL 8.6 EUS and Red Hat Virtualization 4. Organizations unable to patch can mitigate exposure by preventing the `dvb-core` module from loading; RHEL 9 `kernel-rt` was marked will not fix.
Aug 26, 2026
**CVE-2022-45886** is a Linux kernel use-after-free flaw in the DVB core networking component, `drivers/media/dvb-core/dvb_net.c`. A time-of-check/time-of-use race between DVB device disconnection and `dvb_device_open()` can let a low-privileged local attacker crash a vulnerable system or potentially elevate privileges. Exploitation requires access to DVB hardware—either physical access or an authenticated remote user able to predict the hardware's disconnect/reconnect timing. The issue affects kernels through version 6.0.9 and was fixed upstream by serializing open, close, release, and removal operations with a `remove_mutex`; opens during device removal are rejected with `-ENODEV`. Red Hat rated the flaw Moderate with CVSS 7.0 and issued fixes for affected RHEL 8 kernel variants through November 2023; RHEL 9 and RHEL 9 real-time kernels are not affected. Organizations unable to patch can mitigate exposure by blacklisting the `dvb-core` kernel module.
Aug 26, 2026
**CVE-2022-45887** is a memory-leak flaw in the Linux kernel's TTUSB-DEC USB media driver, caused by `ttusb_dec_exit_dvb()` unregistering a DVB frontend without calling `dvb_frontend_detach()`. A local low-privileged user who can repeatedly connect and disconnect an affected device could exhaust kernel memory and cause a denial of service. The issue affects kernel versions through 6.0.9 and is classified as CWE-401; Red Hat rates it Moderate with a CVSS v3.1 score of 4.7. Upstream corrected the cleanup path in commit `517a28133832` by using `dvb_frontend_detach(dec->fe)`, allowing the frontend to be freed properly; Fedora received the fix in stable kernel 6.3.7. Red Hat issued fixes for affected RHEL 8 kernel variants, including 8.6 and 8.8 Extended Update Support, and relevant Red Hat Virtualization 4 deployments; RHEL 9 is unaffected. Organizations unable to patch can reduce exposure by blacklisting the `ttusb_dec` kernel module.
Aug 26, 2026