CVE-2026-53344
Received Received - Intake

NULL Pointer Dereference in Linux Kernel MCP23S08 Driver

Publication date: 2026-07-01

Last updated on: 2026-07-01

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: pinctrl: mcp23s08: Initialize mcp->dev and mcp->addr before regmap init Regmap initialization triggers regcache_maple_populate() which attempts SPI read to populate cache. SPI read requires mcp->dev and mcp->addr to be set, without them, NULL pointer dereference occurs during probe. Move initialization before mcp23s08_spi_regmap_init() call.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-01
Last Modified
2026-07-01
Generated
2026-07-01
AI Q&A
2026-07-01
EPSS Evaluated
N/A
NVD
CVE-2026-53344
EUVD
EUVD-2026-40978

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability exists in the Linux kernel's pinctrl driver for the mcp23s08 device. The issue arises because the device's dev and addr fields are not initialized before the regmap initialization function is called. During regmap initialization, a function attempts to perform an SPI read to populate a cache, which requires these fields to be set. Since they are not initialized, a NULL pointer dereference occurs during the device probe process.

Impact Analysis

The impact of this vulnerability is a NULL pointer dereference during the probe of the mcp23s08 device in the Linux kernel. This can cause the kernel to crash or the device driver to fail to initialize properly, potentially leading to system instability or denial of service conditions on affected systems.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-53344. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart