NULL Pointer Dereference in Linux Kernel IMX8QM HSIO PHY Driver

Publication date: 2026-05-27

Last updated on: 2026-06-25

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: phy: freescale: imx8qm-hsio: fix NULL pointer dereference During the probe the refclk_pad pointer is set to NULL if the 'fsl,refclk-pad-mode' property is not defined in the devicetree node. But in imx_hsio_configure_clk_pad() this pointer is unconditionally used which could result in a NULL pointer dereference. So check the pointer before to use it.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-05-27

Last Modified

2026-06-25

Generated

2026-07-06

AI Q&A

2026-05-27

EPSS Evaluated

2026-07-05

NVD

CVE-2026-45874

EUVD

EUVD-2026-32340

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	From 6.13 (inc) to 6.18.14 (exc)
linux	linux_kernel	From 6.19 (inc) to 6.19.4 (exc)
linux	linux_kernel	From 6.11 (inc) to 6.12.75 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-476	The product dereferences a pointer that it expects to be valid but is NULL.

Attack-Flow Graph

Executive Summary

This vulnerability is a NULL pointer dereference issue in the Linux kernel related to the freescale imx8qm-hsio driver. During the device probe, a pointer named refclk_pad is set to NULL if a specific property ('fsl,refclk-pad-mode') is not defined in the device tree node. However, the code later uses this pointer without checking if it is NULL, which can cause the kernel to dereference a NULL pointer, leading to potential crashes or instability.

Impact Analysis

The impact of this vulnerability is primarily a potential system crash or instability due to the NULL pointer dereference. If exploited or triggered, it could cause the Linux kernel to crash or behave unpredictably, potentially leading to denial of service on affected systems using the freescale imx8qm-hsio hardware.

Hi! I’m here to help you understand CVE-2026-45874. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70