LiveActive security incident?Get immediate response
CVE Record

CVE-2023-53658: spi: bcm-qspi: return error if neither hif_mspi nor mspi is available

In the Linux kernel, the following vulnerability has been resolved: spi: bcm-qspi: return error if neither hif_mspi nor mspi is available If neither a "hif_mspi" nor "mspi" resource is present, the driver will just early exit in probe but still return success. Apart from not doing anything meaningful, this would then also lead to a null pointer access on removal, as platform_get_drvdata() would return NULL, which it would then try to dereference when trying to unregister the spi master. Fix this by unconditionally calling devm_ioremap_resource(), as it can handle a NULL res and will then return a viable ERR_PTR() if we get one. The "return 0;" was previously a "goto qspi_resource_err;" where then ret was returned, but since ret was still initialized to 0 at this place this was a valid conversion in 63c5395bb7a9 ("spi: bcm-qspi: Fix use-after-free on unbind"). The issue was not introduced by this commit, only made more obvious.

UnknownCVSS not scoredNot KEV-listedUpdated
Glexia's TakeAutomated analysislow

Security readout for executives and security teams

Plain-English summary

This Linux kernel issue affects the Broadcom QSPI SPI driver. When required hardware resources are missing, the driver can wrongly report successful startup, then later hit a null pointer during removal. The practical concern is reliability or denial of service on systems using this driver, not confirmed remote compromise.

Executive priority

Treat this as a targeted kernel maintenance item for Linux-based products and appliances. It is not currently supported by evidence of active exploitation, but affected embedded systems should receive vendor-approved kernel updates during normal patch cycles.

Technical view

In bcm-qspi probe handling, absence of both hif_mspi and mspi resources caused an early successful return without meaningful initialization. During remove, platform_get_drvdata() could return NULL and be dereferenced while unregistering the SPI master. The kernel fix changes resource mapping/error handling so the missing-resource case returns an error.

Likely exposure

Exposure appears limited to Linux systems with the Broadcom bcm-qspi driver and affected kernel code paths. The source bundle lists Linux as affected across multiple kernel series, but does not identify distributions, devices, or reachable remote attack surfaces.

Exploitation context

The bundle does not report active exploitation, and KEV is false. The described trigger depends on missing driver resources and later device removal, which suggests operational or local/platform-specific impact rather than a broadly internet-exposed vulnerability.

Researcher notes

The key bug is an inconsistent probe success path that leaves driver state unset, followed by remove-time NULL dereference. Evidence is limited to the CVE record and kernel stable commits; no CVSS, CWE, exploit reports, or distribution advisories are provided.

Mitigation direction

  • Review kernel vendor advisories for patched builds containing the referenced bcm-qspi fix.
  • Prioritize embedded or appliance systems using Broadcom QSPI hardware or this driver.
  • Update affected kernels through normal vendor or stable-kernel channels.
  • If updates are unavailable, ask the vendor for supported mitigation guidance.

Validation and detection

  • Inventory systems running Linux kernels in the affected series listed by the CVE bundle.
  • Check whether the bcm-qspi driver is built, loaded, or used on relevant hardware.
  • Confirm the kernel source or package includes one of the referenced stable fixes.
  • Review platform resource definitions for hif_mspi or mspi presence on applicable devices.
Prepared
Confidence
medium
Sources
10

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2023-53658 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
9Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxfa236a7ef24048bafaeed13f68df35a819794758, fa236a7ef24048bafaeed13f68df35a819794758, fa236a7ef24048bafaeed13f68df35a819794758, fa236a7ef24048bafaeed13f68df35a819794758, fa236a7ef24048bafaeed13f68df35a819794758, fa236a7ef24048bafaeed13f68df35a819794758, fa236a7ef24048bafaeed13f68df35a819794758, fa236a7ef24048bafaeed13f68df35a819794758unaffected
LinuxLinux4.9, 0, 4.14.322, 4.19.291, 5.4.251, 5.10.188, 5.15.121, 6.1.39, 6.4.4, 6.5affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.