CVE-2023-53658: spi: bcm-qspi: return error if neither hif_mspi nor mspi is available
In the Linux kernel, the following vulnerability has been resolved:
spi: bcm-qspi: return error if neither hif_mspi nor mspi is available
If neither a "hif_mspi" nor "mspi" resource is present, the driver will
just early exit in probe but still return success. Apart from not doing
anything meaningful, this would then also lead to a null pointer access
on removal, as platform_get_drvdata() would return NULL, which it would
then try to dereference when trying to unregister the spi master.
Fix this by unconditionally calling devm_ioremap_resource(), as it can
handle a NULL res and will then return a viable ERR_PTR() if we get one.
The "return 0;" was previously a "goto qspi_resource_err;" where then
ret was returned, but since ret was still initialized to 0 at this place
this was a valid conversion in 63c5395bb7a9 ("spi: bcm-qspi: Fix
use-after-free on unbind"). The issue was not introduced by this commit,
only made more obvious.
Security readout for executives and security teams
Plain-English summary
This Linux kernel issue affects the Broadcom QSPI SPI driver. When required hardware resources are missing, the driver can wrongly report successful startup, then later hit a null pointer during removal. The practical concern is reliability or denial of service on systems using this driver, not confirmed remote compromise.
Executive priority
Treat this as a targeted kernel maintenance item for Linux-based products and appliances. It is not currently supported by evidence of active exploitation, but affected embedded systems should receive vendor-approved kernel updates during normal patch cycles.
Technical view
In bcm-qspi probe handling, absence of both hif_mspi and mspi resources caused an early successful return without meaningful initialization. During remove, platform_get_drvdata() could return NULL and be dereferenced while unregistering the SPI master. The kernel fix changes resource mapping/error handling so the missing-resource case returns an error.
Likely exposure
Exposure appears limited to Linux systems with the Broadcom bcm-qspi driver and affected kernel code paths. The source bundle lists Linux as affected across multiple kernel series, but does not identify distributions, devices, or reachable remote attack surfaces.
Exploitation context
The bundle does not report active exploitation, and KEV is false. The described trigger depends on missing driver resources and later device removal, which suggests operational or local/platform-specific impact rather than a broadly internet-exposed vulnerability.
Researcher notes
The key bug is an inconsistent probe success path that leaves driver state unset, followed by remove-time NULL dereference. Evidence is limited to the CVE record and kernel stable commits; no CVSS, CWE, exploit reports, or distribution advisories are provided.
Mitigation direction
Review kernel vendor advisories for patched builds containing the referenced bcm-qspi fix.
Prioritize embedded or appliance systems using Broadcom QSPI hardware or this driver.
Update affected kernels through normal vendor or stable-kernel channels.
If updates are unavailable, ask the vendor for supported mitigation guidance.
Validation and detection
Inventory systems running Linux kernels in the affected series listed by the CVE bundle.
Check whether the bcm-qspi driver is built, loaded, or used on relevant hardware.
Confirm the kernel source or package includes one of the referenced stable fixes.
Review platform resource definitions for hif_mspi or mspi presence on applicable devices.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Potential ATT&CK relevance
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
cve · low confidence lookup
CVE-2023-53658 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
0CVSS vectors
3Timeline events
0ADP providers
9Source links
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
CVE publishedCVE Program
The CVE record was published.
Oct 7, 2025, 15:21 UTC (UTC+00:00)
CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.