Linux Kernel Vulnerability in BCM QSPI Driver

CVE-2023-53658

What is CVE-2023-53658?

A vulnerability exists in the Linux kernel's BCM QSPI driver, which fails to properly handle error states when neither 'hif_mspi' nor 'mspi' resources are present. Instead of managing the absence of resources correctly, the driver proceeds with a null pointer dereference on removal, potentially leading to system instability. The issue stems from a previous code modification that made the flaw more apparent but was not the root cause. The resolution involves implementing proper error management mechanisms that can gracefully handle null resource situations.

References