An issue was discovered in the Linux kernel before 5.2.3. There is a NULL pointer dereference caused by a malicious USB device in the drivers/media/usb/zr364xx/zr364xx.c driver.
https://usn.ubuntu.com/4302-1/
https://usn.ubuntu.com/4286-2/
https://usn.ubuntu.com/4286-1/
https://usn.ubuntu.com/4147-1/
https://security.netapp.com/advisory/ntap-20190905-0002/
https://lists.debian.org/debian-lts-announce/2020/03/msg00001.html
https://lists.debian.org/debian-lts-announce/2020/01/msg00013.html
http://www.openwall.com/lists/oss-security/2019/08/22/5
http://www.openwall.com/lists/oss-security/2019/08/22/4
http://www.openwall.com/lists/oss-security/2019/08/22/3
http://www.openwall.com/lists/oss-security/2019/08/22/2
http://www.openwall.com/lists/oss-security/2019/08/20/2
http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00066.html
http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00064.html