Security readout for executives and security teams
Plain-English summary
This Linux kernel issue can crash certain systems during a power-supply event. It is not described as data theft or privilege escalation. The business concern is availability on affected devices, especially hardware using the AXP288 fuel gauge driver.
Executive priority
Treat this as a targeted availability risk, not a broad emergency. Patch affected Linux endpoints or embedded devices through normal kernel maintenance, with higher priority for systems using AXP288 power hardware in uptime-sensitive roles.
Technical view
A race in the Linux axp288_fuel_gauge power-supply driver can call external_power_changed before info->bat is assigned. The callback may dereference NULL, causing a kernel crash. The fix uses the callback’s valid power_supply argument instead.
Likely exposure
Exposure appears limited to Linux systems running affected kernel versions with the AXP288 fuel gauge driver and relevant hardware path. The source lists Linux kernel versions including 5.18, 6.1.31, 6.3.5, and 6.4, but provides no CPEs.
Exploitation context
The CVSS vector is local, high complexity, low privileges, no user interaction, with high availability impact only. The source bundle says KEV is false and provides no evidence of active exploitation.
Researcher notes
The evidence supports a kernel driver race and NULL pointer dereference. Product exposure is hardware and driver dependent, and the bundle lacks CPEs or distribution-specific backport status. Validate against the exact vendor kernel tree.
Mitigation direction
- Apply a vendor kernel update containing the referenced stable fixes.
- Prioritize affected portable or embedded Linux devices where availability matters.
- Check distribution advisories for backported fixes before relying on version numbers alone.
- If no vendor patch is available, monitor vendor and kernel guidance.
- Avoid deploying listed affected kernels on impacted hardware where feasible.
Validation and detection
- Inventory Linux kernel versions across relevant devices.
- Identify systems using the axp288_fuel_gauge driver or AXP288 hardware.
- Confirm whether the stable fix commits are present or backported.
- Review crash logs for fuel_gauge_external_power_changed NULL dereference indicators.
- Test power-supply change behavior after applying patched kernels.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-362: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2023-53310 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 4.7 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H13.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
4.7MediumVector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/0456b912121e45b3ef54abe3135e5dcb541f956cCVE reference, Linux
- https://git.kernel.org/stable/c/a636c6ba9ce898207f283271cb28511206ab739bCVE reference, Linux
- https://git.kernel.org/stable/c/f8319774d6f1567d6e7d03653174ab0c82c5c66dCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.