---
id: CVE-2025-68819
title: 'media: dvb-usb: dtv5100: fix out-of-bounds in dtv5100_i2c_msg()'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  media: dvb-usb: dtv5100: fix out-of-bounds in dtv5100_i2c_msg()

  rlen value is a user-controlled value, but dtv5100_i2c_msg() does not
  check the size of the rlen value.…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 60688d5e6e6e2ae62f29762d1e3b2aec2dbd3817 <
    c2c293ea7b61f12cdaad1e99a5b4efc58c88960a
  - >-
    Linux >= 60688d5e6e6e2ae62f29762d1e3b2aec2dbd3817 <
    c2305b4c5fc15e20ac06c35738e0578eb4323750
  - >-
    Linux >= 60688d5e6e6e2ae62f29762d1e3b2aec2dbd3817 <
    61f214a878e96e2a8750bf96a98f78c658dba60c
  - >-
    Linux >= 60688d5e6e6e2ae62f29762d1e3b2aec2dbd3817 <
    4a54d8fcb093761e4c56eb211cf4e39bf8401fa1
  - >-
    Linux >= 60688d5e6e6e2ae62f29762d1e3b2aec2dbd3817 <
    fe3e129ab49806aaaa3f22067ebc75c2dfbe4658
  - >-
    Linux >= 60688d5e6e6e2ae62f29762d1e3b2aec2dbd3817 <
    ac92151ff2494130d9fc686055d6bbb9743a673e
  - >-
    Linux >= 60688d5e6e6e2ae62f29762d1e3b2aec2dbd3817 <
    b91e6aafe8d356086cc621bc03e35ba2299e4788
  - Linux 2.6.28
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T15:05:32.291287Z'
published: '2026-01-13'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:09:45.763Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-68819'
references:
  - url: 'https://git.kernel.org/stable/c/c2c293ea7b61f12cdaad1e99a5b4efc58c88960a'
  - url: 'https://git.kernel.org/stable/c/c2305b4c5fc15e20ac06c35738e0578eb4323750'
  - url: 'https://git.kernel.org/stable/c/61f214a878e96e2a8750bf96a98f78c658dba60c'
  - url: 'https://git.kernel.org/stable/c/4a54d8fcb093761e4c56eb211cf4e39bf8401fa1'
  - url: 'https://git.kernel.org/stable/c/fe3e129ab49806aaaa3f22067ebc75c2dfbe4658'
  - url: 'https://git.kernel.org/stable/c/ac92151ff2494130d9fc686055d6bbb9743a673e'
  - url: 'https://git.kernel.org/stable/c/b91e6aafe8d356086cc621bc03e35ba2299e4788'
tags:
  - cve.org
epss: 0.00155
epssPercentile: 0.04185
ingestedAt: '2026-10-16T17:24:46.633Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

media: dvb-usb: dtv5100: fix out-of-bounds in dtv5100_i2c_msg()

rlen value is a user-controlled value, but dtv5100_i2c_msg() does not
check the size of the rlen value. Therefore, if it is set to a value
larger than sizeof(st->data), an out-of-bounds vuln occurs for st->data.

Therefore, we need to add proper range checking to prevent this vuln.

## Affected

- `Linux >= 60688d5e6e6e2ae62f29762d1e3b2aec2dbd3817 < c2c293ea7b61f12cdaad1e99a5b4efc58c88960a`
- `Linux >= 60688d5e6e6e2ae62f29762d1e3b2aec2dbd3817 < c2305b4c5fc15e20ac06c35738e0578eb4323750`
- `Linux >= 60688d5e6e6e2ae62f29762d1e3b2aec2dbd3817 < 61f214a878e96e2a8750bf96a98f78c658dba60c`
- `Linux >= 60688d5e6e6e2ae62f29762d1e3b2aec2dbd3817 < 4a54d8fcb093761e4c56eb211cf4e39bf8401fa1`
- `Linux >= 60688d5e6e6e2ae62f29762d1e3b2aec2dbd3817 < fe3e129ab49806aaaa3f22067ebc75c2dfbe4658`
- `Linux >= 60688d5e6e6e2ae62f29762d1e3b2aec2dbd3817 < ac92151ff2494130d9fc686055d6bbb9743a673e`
- `Linux >= 60688d5e6e6e2ae62f29762d1e3b2aec2dbd3817 < b91e6aafe8d356086cc621bc03e35ba2299e4788`
- `Linux 2.6.28`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.