NULL Pointer Dereference Vulnerability in Linux Kernel affecting MCP23S08 SPI Driver

CVE-2026-53344

What is CVE-2026-53344?

A vulnerability in the MCP23S08 SPI driver of the Linux kernel has been identified, which arises from improper initialization of device parameters. The issue occurs when regmap initialization triggers a SPI read that relies on the 'mcp->dev' and 'mcp->addr' fields being correctly set. If these fields are not initialized, a NULL pointer dereference can happen during the probe stage, potentially impacting system stability. The fix addresses the initialization order, ensuring that required values are established before the SPI-related functions are called.

References