Executive Summary

CVE-2024-53063 exposes a Linux kernel flaw in the DVB driver where static minor number handling lacks bounds checks when CONFIG_DVB_DYNAMIC_MINORS is disabled. The missing validation in dvb_register_device() and dvb_device_open() can lead to out‑of‑memory or out‑of‑bounds memory accesses if adapters register devices inconsistently, potentially allowing memory corruption or denial‑of‑service. The patch adds explicit guards to enforce proper limits, mitigating the risk.

---

Authoritative CVE Metadata - CVSS Base Score: 7.8 (HIGH) - Published: 2024-11-19T18:15:26.180 - Last Modified: 2026-09-18T16:17:01.373

Original Description: In the Linux kernel, the following vulnerability has been resolved:

media: dvbdev: prevent the risk of out of memory access

The dvbdev contains a static variable used to store dvb minors.

The behavior of it depends if CONFIG_DVB_DYNAMIC_MINORS is set or not. When not set, dvb_register_device() won't check for boundaries, as it will rely that a previous call to dvb_register_adapter() would already be enforcing it.

On a similar way, dvb_device_open() uses the assumption that the register functions already did the needed checks.

This can be fragile if some device ends using different calls. This also generate warnings on static check analysers like Coverity.

So, add explicit guards to prevent potential risk of OOM issues.

"What lies behind us and what lies before us are tiny matters compared to what lies within us."

— Walt Emerson