In the Linux kernel, the following vulnerability has been resolved:
hwmon: (coretemp) Simplify platform device handling
Coretemp's platform driver is unconventional. All the real work is done
globally by the initcall and CPU hotplug notifiers, while the "driver"
effectively just wraps an allocation and the registration of the hwmon
interface in a long-winded round-trip through the driver core. The whole
logic of dynamically creating and destroying platform devices to bring
the interfaces up and down is error prone, since it assumes
platform_device_add() will synchronously bind the driver and set drvdata
before it returns, thus results in a NULL dereference if drivers_autoprobe
is turned off for the platform bus. Furthermore, the unusual approach of
doing that from within a CPU hotplug notifier, already commented in the
code that it deadlocks suspend, also causes lockdep issues for other
drivers or subsystems which may want to legitimately register a CPU
hotplug notifier from a platform bus notifier.
All of these issues can be solved by ripping this unusual behaviour out
completely, simply tying the platform devices to the lifetime of the
module itself, and directly managing the hwmon interfaces from the
hotplug notifiers. There is a slight user-visible change in that
/sys/bus/platform/drivers/coretemp will no longer appear, and
/sys/devices/platform/coretemp.n will remain present if package n is
hotplugged off, but hwmon users should really only be looking for the
presence of the hwmon interfaces, whose behaviour remains unchanged.
Security readout for executives and security teams
Plain-English summary
CVE-2023-53612 is a Linux kernel core temperature monitoring issue. In unusual platform-driver configurations, the coretemp driver could hit a NULL pointer dereference, and its CPU hotplug design could create suspend or lock-order problems. The sources do not provide CVSS, confirmed exploitation, or broad impact evidence.
Executive priority
Treat this as routine-to-moderate kernel maintenance unless affected systems are safety-critical, depend on CPU temperature telemetry, or have unusual driver probing settings. Prioritize through normal kernel patch cycles and vendor advisories.
Technical view
The coretemp hwmon driver used unconventional platform device creation from CPU hotplug notifiers. It assumed platform_device_add() would bind synchronously and set driver data, which fails when platform bus drivers_autoprobe is disabled, causing NULL dereference. The fix removes this pattern, ties platform devices to module lifetime, and manages hwmon interfaces directly from hotplug notifiers.
Likely exposure
Exposure is limited to Linux systems running affected kernel versions with the coretemp hwmon driver path present. The bundle lists Linux kernel versions from 4.10 through 6.3-era branches as affected, but does not identify distributions, appliances, or cloud services.
Exploitation context
The provided sources do not show active exploitation, public exploit availability, or KEV listing. The described failure depends on kernel driver and platform bus behavior, especially drivers_autoprobe being disabled, plus CPU hotplug and suspend interactions.
Researcher notes
Evidence is narrow and source-grounded: no CVSS, CWE, exploit, or distribution mapping is included. Analysis should focus on fixed commit presence, coretemp availability, platform bus autoprobe configuration, and operational dependence on hwmon sysfs interfaces.
Mitigation direction
Apply vendor kernel updates that include the listed Linux stable commits.
Check distribution advisories for backported fixes on supported kernel packages.
Avoid treating sysfs path changes as regressions without reviewing the kernel fix notes.
Update monitoring that depends on /sys/bus/platform/drivers/coretemp if needed.
Follow vendor guidance if no packaged fix is available for your kernel branch.
Validation and detection
Inventory Linux kernel versions and compare them with affected branches in the CVE record.
Confirm whether the coretemp hwmon driver is built, loaded, or used.
Check vendor kernel changelogs for the referenced stable commit IDs.
Review monitoring for assumptions about /sys/bus/platform/drivers/coretemp.
Look for suspend, CPU hotplug, or hwmon errors on relevant hosts.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Potential ATT&CK relevance
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
cve · low confidence lookup
CVE-2023-53612 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
0CVSS vectors
3Timeline events
0ADP providers
7Source links
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
CVE publishedCVE Program
The CVE record was published.
Oct 4, 2025, 15:44 UTC (UTC+00:00)
CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.