CVE-2026-53344

Analyzed Analyzed - Analysis Complete

NULL Pointer Dereference in Linux Kernel MCP23S08 Driver

Publication date: 2026-07-01

Last updated on: 2026-07-23

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: pinctrl: mcp23s08: Initialize mcp->dev and mcp->addr before regmap init Regmap initialization triggers regcache_maple_populate() which attempts SPI read to populate cache. SPI read requires mcp->dev and mcp->addr to be set, without them, NULL pointer dereference occurs during probe. Move initialization before mcp23s08_spi_regmap_init() call.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-01

Last Modified

2026-07-23

Generated

2026-08-11

AI Q&A

2026-07-01

EPSS Evaluated

2026-08-09

NVD

CVE-2026-53344

EUVD

EUVD-2026-40978

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	From 6.19 (inc) to 7.0.13 (exc)
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-908	The product uses or accesses a resource that has not been initialized.

Attack-Flow Graph

Executive Summary

This vulnerability exists in the Linux kernel's pinctrl driver for the mcp23s08 device. The issue arises because the device's dev and addr fields are not initialized before the regmap initialization function is called. During regmap initialization, a function attempts to perform an SPI read to populate a cache, which requires these fields to be set. Since they are not initialized, a NULL pointer dereference occurs during the device probe process.

Impact Analysis

The impact of this vulnerability is a NULL pointer dereference during the probe of the mcp23s08 device in the Linux kernel. This can cause the kernel to crash or the device driver to fail to initialize properly, potentially leading to system instability or denial of service conditions on affected systems.

Mitigation Strategies

The vulnerability has been resolved by initializing mcp->dev and mcp->addr before the regmap initialization call in the Linux kernel pinctrl driver for mcp23s08.

To mitigate this vulnerability, you should update your Linux kernel to a version that includes this fix where the initialization order has been corrected.

Hi! I’m here to help you understand CVE-2026-53344. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70