CVE-2023-54066: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54066 is a null pointer dereference vulnerability in the Linux kernel's media/dvb-usb-v2/gl861 driver, specifically in the gl861_i2c_master_xfer function. The flaw exists because user-controlled I2C message data (msg[i].buf) is accessed without validating msg[i].len, allowing a null pointer dereference when msg[i].buf is null and msg[i].len is zero. It affects the Linux kernel across multiple stable branches, with patches applied in versions 5.10.197, 5.15.133, 6.1.55, 6.5.5, and 6.6. The vulnerability was published on December 24, 2025, and carries an EPSS score of approximately 0.018% (Feedly, ENISA EUVD).

The root cause is a missing input validation (CWE-476: NULL Pointer Dereference) in the gl861_i2c_master_xfer function within the Linux kernel's DVB USB v2 GL861 driver. When processing I2C transfer messages, the function checks msg[i].buf for null but does not validate msg[i].len; a crafted message with a null buffer and zero length bypasses the buffer check, and subsequent access to msg[i].buf[0] triggers a kernel null pointer dereference. Exploitation requires local access to a system with a GL861-based DVB USB device attached, and the ability to submit crafted I2C messages. The fix adds a length check (msg[i].len) before accessing the buffer, mirroring a similar fix applied to the az6027 driver (commit 0ed554fd769a) (Feedly, ENISA EUVD).

Successful exploitation causes a kernel crash (denial of service) on systems with a GL861-based DVB USB device. Because the dereference occurs in kernel space, it results in a kernel panic or oops, making the affected system unavailable until rebooted. There is no evidence of confidentiality or integrity impact beyond the availability disruption, and lateral movement potential is limited given the local access requirement.

Apply the upstream Linux kernel patches that add the msg[i].len validation check in gl861_i2c_master_xfer. Fixed versions include Linux kernel 5.10.197, 5.15.133, 6.1.55, 6.5.5, and 6.6. Distributions such as SUSE have released updated kernel packages incorporating this fix; users should apply the latest kernel update from their distribution vendor. As a workaround where patching is not immediately possible, restricting physical access to USB ports or disabling the dvb-usb-gl861 kernel module (modprobe -r dvb-usb-gl861) can reduce exposure (ENISA EUVD, Feedly).