BaseFortify

Publication date: 2025-10-07

Last updated on: 2026-02-26

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: wcd938x: fix missing mbhc init error handling MBHC initialisation can fail so add the missing error handling to avoid dereferencing an error pointer when later configuring the jack: Unable to handle kernel paging request at virtual address fffffffffffffff8 pc : wcd_mbhc_start+0x28/0x380 [snd_soc_wcd_mbhc] lr : wcd938x_codec_set_jack+0x28/0x48 [snd_soc_wcd938x] Call trace: wcd_mbhc_start+0x28/0x380 [snd_soc_wcd_mbhc] wcd938x_codec_set_jack+0x28/0x48 [snd_soc_wcd938x] snd_soc_component_set_jack+0x28/0x8c [snd_soc_core] qcom_snd_wcd_jack_setup+0x7c/0x19c [snd_soc_qcom_common] sc8280xp_snd_init+0x20/0x2c [snd_soc_sc8280xp] snd_soc_link_init+0x28/0x90 [snd_soc_core] snd_soc_bind_card+0x628/0xbfc [snd_soc_core] snd_soc_register_card+0xec/0x104 [snd_soc_core] devm_snd_soc_register_card+0x4c/0xa4 [snd_soc_core] sc8280xp_platform_probe+0xf0/0x108 [snd_soc_sc8280xp]

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-10-07

Last Modified

2026-02-26

Generated

2026-07-06

AI Q&A

2025-10-07

EPSS Evaluated

2026-07-05

NVD

CVE-2023-53666

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	6.5
linux	linux_kernel	From 5.16 (inc) to 6.1.42 (inc)
qualcomm	wcd938x	*
linux	snd_soc_wcd938x	*
linux	kernel	*
linux	snd_soc_sc8280xp	*
linux	snd_soc_core	*
linux	snd_soc_qcom_common	*
linux	snd_soc_wcd_mbhc	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is in the Linux kernel's ASoC codec driver for wcd938x. It involves missing error handling during MBHC (Mic Bias Headset Control) initialization. If the initialization fails, the code does not properly handle the error and later attempts to dereference an error pointer, which can cause a kernel paging fault and potentially crash the system.

Impact Analysis

The impact of this vulnerability is that it can cause the Linux kernel to crash due to an unhandled error pointer dereference during audio codec initialization. This can lead to system instability or denial of service on affected devices using the wcd938x codec driver.

Hi! I’m here to help you understand CVE-2023-53666. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70