BaseFortify

Publication date: 2025-10-04

Last updated on: 2026-03-21

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: u_serial: Add null pointer check in gserial_resume Consider a case where gserial_disconnect has already cleared gser->ioport. And if a wakeup interrupt triggers afterwards, gserial_resume gets called, which will lead to accessing of gser->ioport and thus causing null pointer dereference.Add a null pointer check to prevent this. Added a static spinlock to prevent gser->ioport from becoming null after the newly added check.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-10-04

Last Modified

2026-03-21

Generated

2026-07-06

AI Q&A

2025-10-04

EPSS Evaluated

2026-07-05

NVD

CVE-2023-53551

EUVD

EUVD-2025-32285

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	From 5.11 (inc) to 5.15.97 (exc)
linux	linux_kernel	From 5.16 (inc) to 6.1.15 (exc)
linux	linux_kernel	From 5.8 (inc) to 5.10.171 (exc)
linux	linux_kernel	From 6.2 (inc) to 6.2.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-476	The product dereferences a pointer that it expects to be valid but is NULL.

Attack-Flow Graph

Executive Summary

This vulnerability occurs in the Linux kernel's USB gadget serial driver (u_serial). If the gserial_disconnect function has cleared the ioport pointer and then a wakeup interrupt triggers, the gserial_resume function may be called and attempt to access the now null ioport pointer. This leads to a null pointer dereference, which can cause a system crash or instability. The fix adds a null pointer check in gserial_resume and a static spinlock to prevent ioport from becoming null unexpectedly.

Impact Analysis

This vulnerability can cause a null pointer dereference in the Linux kernel, potentially leading to a system crash or instability when the USB gadget serial driver resumes after a disconnect. This could disrupt normal system operation or cause denial of service.

Hi! I’m here to help you understand CVE-2023-53551. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70