CVE-2023-53437

kernel: media: uvcvideo: Handle cameras with invalid descriptors

Loading…

Severity

Moderate

Red Hat Product Security

4.6

CVSS 3.1

Review impact separately from score.

Published · September 18, 2025

Updated · July 22, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

media: uvcvideo: Handle cameras with invalid descriptors

If the source entity does not contain any pads, do not create a link.

Statement

This patch addresses a potential invalid memory access in the UVC (USB Video Class) subsystem when handling malformed or incomplete camera descriptors. Previously, a missing or invalid source entity without pads could cause link creation to fail with undefined behavior.

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

No mitigation is specified in collected source.

CVSS / CWE

CVSS 3.1 · 4.6
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-20 · Improper Input Validation