CVE-2023-54321
Full vulnerability record from the local CVENow database.
Description
In the Linux kernel, the following vulnerability has been resolved: driver core: fix potential null-ptr-deref in device_add() I got the following null-ptr-deref report while doing fault injection test: BUG: kernel NULL pointer dereference, address: 0000000000000058 CPU: 2 PID: 278 Comm: 37-i2c-ds2482 Tainted: G B W N 6.1.0-rc3+ RIP: 0010:klist_put+0x2d/0xd0 Call Trace: <TASK> klist_remove+0xf1/0x1c0 device_release_driver_internal+0x196/0x210 bus_remove_device+0x1bd/0x240 device_add+0xd3d/0x1100 w1_add_master_device+0x476/0x490 [wire] ds2482_probe+0x303/0x3e0 [ds2482] This is how it happened: w1_alloc_dev() // The dev->driver is set to w1_master_driver. memcpy(&dev->dev, device, sizeof(struct device)); device_add() bus_add_device() dpm_sysfs_add() // It fails, calls bus_remove_device. // error path bus_remove_device() // The dev->driver is not null, but driver is not bound. __device_release_driver() klist_remove(&dev->p->knode_driver) <-- It causes null-ptr-deref. // normal path bus_probe_device() // It's not called yet. device_bind_driver() If dev->driver is set, in the error path after calling bus_add_device() in device_add(), bus_remove_device() is called, then the device will be detached from driver. But device_bind_driver() is not called yet, so it causes null-ptr-deref while access the 'knode_driver'. To fix this, set dev->driver to null in the error path before calling bus_remove_device().
Severity
MEDIUM
CVSS score
5.5
(v3.1)
Vulnerability status
Analyzed
Source identifier
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Published
2025-12-30 13:16:21.410000
Last modified
2026-11-05 21:17:32.410000
View original CVE JSON
{
"id": "CVE-2023-54321",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-12-30T13:16:21.410",
"lastModified": "2026-11-05T21:17:32.410",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndriver core: fix potential null-ptr-deref in device_add()\n\nI got the following null-ptr-deref report while doing fault injection test:\n\nBUG: kernel NULL pointer dereference, address: 0000000000000058\nCPU: 2 PID: 278 Comm: 37-i2c-ds2482 Tainted: G B W N 6.1.0-rc3+\nRIP: 0010:klist_put+0x2d/0xd0\nCall Trace:\n <TASK>\n klist_remove+0xf1/0x1c0\n device_release_driver_internal+0x196/0x210\n bus_remove_device+0x1bd/0x240\n device_add+0xd3d/0x1100\n w1_add_master_device+0x476/0x490 [wire]\n ds2482_probe+0x303/0x3e0 [ds2482]\n\nThis is how it happened:\n\nw1_alloc_dev()\n // The dev->driver is set to w1_master_driver.\n memcpy(&dev->dev, device, sizeof(struct device));\n device_add()\n bus_add_device()\n dpm_sysfs_add() // It fails, calls bus_remove_device.\n\n // error path\n bus_remove_device()\n // The dev->driver is not null, but driver is not bound.\n __device_release_driver()\n klist_remove(&dev->p->knode_driver) <-- It causes null-ptr-deref.\n\n // normal path\n bus_probe_device() // It's not called yet.\n device_bind_driver()\n\nIf dev->driver is set, in the error path after calling bus_add_device()\nin device_add(), bus_remove_device() is called, then the device will be\ndetached from driver. But device_bind_driver() is not called yet, so it\ncauses null-ptr-deref while access the 'knode_driver'. To fix this, set\ndev->driver to null in the error path before calling bus_remove_device()."
},
{
"lang": "es",
"value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nnúcleo del controlador: corrige una potencial desreferencia de puntero nulo en device_add()\n\nRecibí el siguiente informe de desreferencia de puntero nulo mientras realizaba una prueba de inyección de fallos:\n\nERROR: desreferencia de puntero NULL del kernel, dirección: 0000000000000058\nCPU: 2 PID: 278 Comm: 37-i2c-ds2482 Tainted: G B W N 6.1.0-rc3+\nRIP: 0010:klist_put+0x2d/0xd0\nTraza de llamadas:\n \n klist_remove+0xf1/0x1c0\n device_release_driver_internal+0x196/0x210\n bus_remove_device+0x1bd/0x240\n device_add+0xd3d/0x1100\n w1_add_master_device+0x476/0x490 [wire]\n ds2482_probe+0x303/0x3e0 [ds2482]\n\nAsí es como ocurrió:\n\nw1_alloc_dev()\n // El dev->driver se establece en w1_master_driver.\n memcpy(&dev->dev, device, sizeof(struct device));\n device_add()\n bus_add_device()\n dpm_sysfs_add() // Falla, llama a bus_remove_device.\n\n // ruta de error\n bus_remove_device()\n // El dev->driver no es nulo, pero el controlador no está enlazado.\n __device_release_driver()\n klist_remove(&dev->p->knode_driver) <-- Causa una desreferencia de puntero nulo.\n\n // ruta normal\n bus_probe_device() // Aún no se ha llamado.\n device_bind_driver()\n\nSi dev->driver está establecido, en la ruta de error después de llamar a bus_add_device() en device_add(), se llama a bus_remove_device(), entonces el dispositivo será desvinculado del controlador. Pero device_bind_driver() aún no se ha llamado, por lo que causa una desreferencia de puntero nulo al acceder a 'knode_driver'. Para solucionar esto, establece dev->driver en nulo en la ruta de error antes de llamar a bus_remove_device()."
}
],
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "unaffected",
"programFiles": [
"drivers/base/core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "57eee3d23e8833ca18708b374c648235691942ba",
"lessThan": "97aa8fb74bbe9aaf4ed5962a784f73b071bd16bf",
"versionType": "git",
"status": "affected"
},
{
"version": "57eee3d23e8833ca18708b374c648235691942ba",
"lessThan": "2c59650d078b1b3f1ea50d5f8ee9fcc537dc02d3",
"versionType": "git",
"status": "affected"
},
{
"version": "57eee3d23e8833ca18708b374c648235691942ba",
"lessThan": "7cf515bf9e8c2908dc170ecf2df117162a16c9c5",
"versionType": "git",
"status": "affected"
},
{
"version": "57eee3d23e8833ca18708b374c648235691942ba",
"lessThan": "17982304806c5c10924e73f7ca5556e0d7378452",
"versionType": "git",
"status": "affected"
},
{
"version": "57eee3d23e8833ca18708b374c648235691942ba",
"lessThan": "f6837f34a34973ef6600c08195ed300e24e97317",
"versionType": "git",
"status": "affected"
}
]
},
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "affected",
"programFiles": [
"drivers/base/core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "2.6.26",
"status": "affected"
},
{
"version": "0",
"lessThan": "2.6.26",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "5.10.249",
"lessThanOrEqual": "5.10.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "5.15.99",
"lessThanOrEqual": "5.15.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.1.16",
"lessThanOrEqual": "6.1.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.2.3",
"lessThanOrEqual": "6.2.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.3",
"lessThanOrEqual": "*",
"versionType": "original_commit_for_fix",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.8,
"impactScore": 3.6
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-11-05T20:27:22.600288Z",
"id": "CVE-2023-54321",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-476"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "2.6.26",
"versionEndExcluding": "5.10.249",
"matchCriteriaId": "9D348797-6EB9-4DCA-AB7C-43C12A032085"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.11",
"versionEndExcluding": "5.15.99",
"matchCriteriaId": "5B8B2AC9-2F31-4A0F-96F5-7E26B50B27BB"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.16",
"versionEndExcluding": "6.1.16",
"matchCriteriaId": "0FD95FDA-6525-4B13-B3FB-49D9995FD8ED"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.2",
"versionEndExcluding": "6.2.3",
"matchCriteriaId": "88C67289-22AD-4CA9-B202-5F5A80E5BA4B"
}
]
}
]
}
],
"references": [
{
"url": "https://git.kernel.org/stable/c/17982304806c5c10924e73f7ca5556e0d7378452",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/2c59650d078b1b3f1ea50d5f8ee9fcc537dc02d3",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/7cf515bf9e8c2908dc170ecf2df117162a16c9c5",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/97aa8fb74bbe9aaf4ed5962a784f73b071bd16bf",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/f6837f34a34973ef6600c08195ed300e24e97317",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
}
]
}