Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2023-53497— media: vsp1: Replace vb2_is_streaming() with vb2_start_streaming_called()

Quick assessment

Affected

Linux Linux

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于vb2_is_streaming函数使用不当，可能导致空指针取消引用。

AI Predicted 6.5 Difficulty: Moderate EPSS 0.16% · P5 Updated May 13, 2026

Possible ATT&CK Techniques 2 AI

T1059 · Command and Scripting Interpreter T1203 · Exploitation for Client Execution

Affected Version Matrix 8

Vendor	Product	Version Range	Status
Linux	Linux	`a10b215325740376ed551814a37d1f8e9d6b1ced< 960dc0aa4aa149f6f39125394f4feb51b7addc60`	affected
		`a10b215325740376ed551814a37d1f8e9d6b1ced< b54f74214adf4e77cba6badf488c564dd353b491`	affected
		`a10b215325740376ed551814a37d1f8e9d6b1ced< 52d8caca3d533cc499f1255be25576ffd936ec95`	affected
		`6.2`	affected
		`< 6.2`	unaffected
		`6.2.15≤ 6.2.*`	unaffected
		`6.3.2≤ 6.3.*`	unaffected
		`6.4≤ *`	unaffected

Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2023-53497

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

media: vsp1: Replace vb2_is_streaming() with vb2_start_streaming_called()

Source: CVE Program / CVE List V5

Vulnerability Description

In the Linux kernel, the following vulnerability has been resolved: media: vsp1: Replace vb2_is_streaming() with vb2_start_streaming_called() The vsp1 driver uses the vb2_is_streaming() function in its .buf_queue() handler to check if the .start_streaming() operation has been called, and decide whether to just add the buffer to an internal queue, or also trigger a hardware run. vb2_is_streaming() relies on the vb2_queue structure's streaming field, which used to be set only after calling the .start_streaming() operation. Commit a10b21532574 ("media: vb2: add (un)prepare_streaming queue ops") changed this, setting the .streaming field in vb2_core_streamon() before enqueuing buffers to the driver and calling .start_streaming(). This broke the vsp1 driver which now believes that .start_streaming() has been called when it hasn't, leading to a crash: [ 881.058705] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000020 [ 881.067495] Mem abort info: [ 881.070290] ESR = 0x0000000096000006 [ 881.074042] EC = 0x25: DABT (current EL), IL = 32 bits [ 881.079358] SET = 0, FnV = 0 [ 881.082414] EA = 0, S1PTW = 0 [ 881.085558] FSC = 0x06: level 2 translation fault [ 881.090439] Data abort info: [ 881.093320] ISV = 0, ISS = 0x00000006 [ 881.097157] CM = 0, WnR = 0 [ 881.100126] user pgtable: 4k pages, 48-bit VAs, pgdp=000000004fa51000 [ 881.106573] [0000000000000020] pgd=080000004f36e003, p4d=080000004f36e003, pud=080000004f7ec003, pmd=0000000000000000 [ 881.117217] Internal error: Oops: 0000000096000006 [#1] PREEMPT SMP [ 881.123494] Modules linked in: rcar_fdp1 v4l2_mem2mem [ 881.128572] CPU: 0 PID: 1271 Comm: yavta Tainted: G B 6.2.0-rc1-00023-g6c94e2e99343 #556 [ 881.138061] Hardware name: Renesas Salvator-X 2nd version board based on r8a77965 (DT) [ 881.145981] pstate: 400000c5 (nZcv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 881.152951] pc : vsp1_dl_list_add_body+0xa8/0xe0 [ 881.157580] lr : vsp1_dl_list_add_body+0x34/0xe0 [ 881.162206] sp : ffff80000c267710 [ 881.165522] x29: ffff80000c267710 x28: ffff000010938ae8 x27: ffff000013a8dd98 [ 881.172683] x26: ffff000010938098 x25: ffff000013a8dc00 x24: ffff000010ed6ba8 [ 881.179841] x23: ffff00000faa4000 x22: 0000000000000000 x21: 0000000000000020 [ 881.186998] x20: ffff00000faa4000 x19: 0000000000000000 x18: 0000000000000000 [ 881.194154] x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000 [ 881.201309] x14: 0000000000000000 x13: 746e696174206c65 x12: ffff70000157043d [ 881.208465] x11: 1ffff0000157043c x10: ffff70000157043c x9 : dfff800000000000 [ 881.215622] x8 : ffff80000ab821e7 x7 : 00008ffffea8fbc4 x6 : 0000000000000001 [ 881.222779] x5 : ffff80000ab821e0 x4 : ffff70000157043d x3 : 0000000000000020 [ 881.229936] x2 : 0000000000000020 x1 : ffff00000e4f6400 x0 : 0000000000000000 [ 881.237092] Call trace: [ 881.239542] vsp1_dl_list_add_body+0xa8/0xe0 [ 881.243822] vsp1_video_pipeline_run+0x270/0x2a0 [ 881.248449] vsp1_video_buffer_queue+0x1c0/0x1d0 [ 881.253076] __enqueue_in_driver+0xbc/0x260 [ 881.257269] vb2_start_streaming+0x48/0x200 [ 881.261461] vb2_core_streamon+0x13c/0x280 [ 881.265565] vb2_streamon+0x3c/0x90 [ 881.269064] vsp1_video_streamon+0x2fc/0x3e0 [ 881.273344] v4l_streamon+0x50/0x70 [ 881.276844] __video_do_ioctl+0x2bc/0x5d0 [ 881.280861] video_usercopy+0x2a8/0xc80 [ 881.284704] video_ioctl2+0x20/0x40 [ 881.288201] v4l2_ioctl+0xa4/0xc0 [ 881.291525] __arm64_sys_ioctl+0xe8/0x110 [ 881.295543] invoke_syscall+0x68/0x190 [ 881.299303] el0_svc_common.constprop.0+0x88/0x170 [ 881.304105] do_el0_svc+0x4c/0xf0 [ 881.307430] el0_svc+0x4c/0xa0 [ 881.310494] el0t_64_sync_handler+0xbc/0x140 [ 881.314773] el0t_64_sync+0x190/0x194 [ 881.318450] Code: d50323bf d65f03c0 91008263 f9800071 (885f7c60) [ 881.324551] ---[ end trace 0000000000000000 ]--- [ 881.329173] note: yavta[1271] exited with preempt_count 1 A different r ---truncated---

Source: CVE Program / CVE List V5

CVSS Information

N/A

Source: CVE Program / CVE List V5

Vulnerability Type

N/A

Source: CVE Program / CVE List V5

Vulnerability Title

Linux kernel 安全漏洞

Source: CNNVD (China National Vulnerability Database)

Vulnerability Description

Source: CNNVD (China National Vulnerability Database)

CVSS Information

N/A

Source: CNNVD (China National Vulnerability Database)

Vulnerability Type

N/A

Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Linux	Linux	a10b215325740376ed551814a37d1f8e9d6b1ced ~ 960dc0aa4aa149f6f39125394f4feb51b7addc60	-
Linux	Linux	6.2	-

II. Public POCs for CVE-2023-53497

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2023-53497

请登录查看更多情报信息。

Patches & Fixes for CVE-2023-53497 (1)

Making sure you're not a bot!

https://www.cve.org/CVERecord?id=CVE-2023-53497

Same Patch Batch · Linux · 2025-10-01 · 169 CVEs total

CVE-2023-53517	9.8 CRITICAL	tipc: do not update mtu if msg_max is too small in mtu negotiation
CVE-2023-53454	8.8 HIGH	HID: multitouch: Correct devm device reference for hidinput input_dev name
CVE-2025-39918	8.8 HIGH	wifi: mt76: fix linked list corruption
CVE-2025-39919	8.8 HIGH	wifi: mt76: mt7996: add missing check for rx wcid entries
CVE-2022-50442	8.4 HIGH	fs/ntfs3: Validate buffer length while parsing index
CVE-2023-53493	8.4 HIGH	accel/qaic: tighten bounds checking in decode_message()
CVE-2022-50421	7.8 HIGH	rpmsg: char: Avoid double destroy of default endpoint
CVE-2023-53484	7.8 HIGH	lib: cpu_rmap: Avoid use after free on rmap->obj array entries
CVE-2022-50440	7.8 HIGH	drm/vmwgfx: Validate the box size for the snooped cursor
CVE-2023-53465	7.8 HIGH	soundwire: qcom: fix storing port config out-of-bounds
CVE-2025-39924	7.8 HIGH	erofs: fix invalid algorithm for encoded extents
CVE-2023-53510	7.8 HIGH	scsi: ufs: core: Fix handling of lrbp->cmd
CVE-2022-50454	7.8 HIGH	drm/nouveau: fix a use-after-free in nouveau_gem_prime_import_sg_table()
CVE-2025-39927	7.8 HIGH	ceph: fix race condition validating r_parent before applying state
CVE-2023-53506	7.8 HIGH	udf: Do not bother merging very long extents
CVE-2022-50437	7.8 HIGH	drm/msm/hdmi: fix memory corruption with too many bridges
CVE-2023-53494	7.8 HIGH	crypto: xts - Handle EBUSY correctly
CVE-2023-53492	7.8 HIGH	netfilter: nf_tables: do not ignore genmask when looking up chain by id
CVE-2022-50432	7.8 HIGH	kernfs: fix use-after-free in __kernfs_remove
CVE-2023-53490	7.8 HIGH	mptcp: fix disconnect vs accept race

Showing top 20 of 169 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same product: Linux

Same vendor: Linux

V. Comments for CVE-2023-53497

No comments yet

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2023-53497— media: vsp1: Replace vb2_is_streaming() with vb2_start_streaming_called()

Quick assessment

Possible ATT&CK Techniques 2 AI

Affected Version Matrix 8

I. Basic Information for CVE-2023-53497

Vulnerability Information

Vulnerability Title

Vulnerability Description

CVSS Information

Vulnerability Type

Vulnerability Title

Vulnerability Description

CVSS Information

Vulnerability Type

Affected Products

II. Public POCs for CVE-2023-53497

III. Intelligence Information for CVE-2023-53497

Patches & Fixes for CVE-2023-53497 (1)

Same Patch Batch · Linux · 2025-10-01 · 169 CVEs total

IV. Related Vulnerabilities

V. Comments for CVE-2023-53497

Leave a comment