Null Pointer Dereference in Linux Kernel USB Gadget Component

CVE-2023-53356

What is CVE-2023-53356?

A vulnerability has been identified in the Linux kernel's USB gadget subsystem, specifically in the u_serial component. This issue arises when the gserial_disconnect function clears gser->ioport, leading to a potential null pointer dereference in the gserial_suspend call if executed afterwards. To mitigate this risk, a null pointer check has been implemented, alongside a static spinlock to ensure that gser->ioport does not become null post-check, enhancing the overall stability and security of the system.

References