Executive brief
The tda18250 silicon tuner driver in the Linux kernel contains an integer overflow vulnerability when processing tuner parameters. When a variable is set to zero, a subsequent bitwise shift operation produces undefined behavior. While the vulnerability has no known exploitation vector, it could cause system instability or unexpected behavior in devices using this tuner.
Technical details
The vulnerability exists in the tda18250 driver's PLL calculation function (tda18250_pll_calc) in drivers/media/tuners/tda18250.c. The vulnerable code fails to properly validate the exp variable before using it in a left bitwise shift operation (1 << (exp - 1)). When exp equals zero, this results in a negative shift count, leading to undefined behavior. The fix checks if exp equals 0 and sets it to 1 instead, preventing the invalid shift. This is a kernel code defect without a known network or local exploitation vector, but it was addressed in stable kernel releases.
Affected products
- Linux Linux kernel all versions with tda18250 driver
Timeline
- 2026-09-16: disclosed
- 2026-09-14: patched