Linux Kernel Vulnerability in Overlay Management by Linux Foundation

CVE-2023-53856

What is CVE-2023-53856?

A vulnerability exists in the Linux kernel related to the overlay management system. The issue arises during the early initialization process where calls to 'of_changeset_init()' are incorrectly placed. If 'of_overlay_fdt_apply()' fails due to an unresolved symbol, it leads to an uninitialized state in the 'overlay_changeset.cset.entries' list. Consequently, any attempt to clean up this partial overlay state will trigger a NULL-pointer dereference, resulting in a crash. The solution involves repositioning the initialization call to where other early setups occur to ensure proper state management during overlay applications.

References