LiveActive security incident?Get immediate response
CVE Record

CVE-2023-53664: OPP: Fix potential null ptr dereference in dev_pm_opp_get_required_pstate()

In the Linux kernel, the following vulnerability has been resolved: OPP: Fix potential null ptr dereference in dev_pm_opp_get_required_pstate() "opp" pointer is dereferenced before the IS_ERR_OR_NULL() check. Fix it by removing the dereference to cache opp_table and dereference it directly where opp_table is used. This fixes the following smatch warning: drivers/opp/core.c:232 dev_pm_opp_get_required_pstate() warn: variable dereferenced before IS_ERR check 'opp' (see line 230)

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

This Linux kernel issue is a potential crash condition caused by code checking a pointer only after it may already have been used. The provided sources do not include CVSS, exploitation evidence, or business-impact detail, so urgency should be based on kernel exposure and vendor patch status rather than assumed active attack activity.

Executive priority

Treat this as a patch-management item until stronger impact evidence appears. It deserves attention where affected Linux kernels are broadly deployed, but the provided sources do not support emergency prioritization or claims of active exploitation.

Technical view

The flaw is in the OPP subsystem function dev_pm_opp_get_required_pstate(). The CVE description says an opp pointer is dereferenced before IS_ERR_OR_NULL() validation, creating a potential null pointer dereference. Kernel stable commits are listed as references, but the source bundle does not describe exploitability, reachable attack surface, or privilege requirements.

Likely exposure

Exposure is limited to Linux systems running affected kernel versions identified in the CVE source data, including 6.5-related entries. The bundle does not identify specific distributions, appliances, cloud images, or configurations that expose this path.

Exploitation context

The provided bundle marks KEV as false and gives no cited evidence of active exploitation. It describes a static-analysis warning and a kernel fix, but not any public exploit, crash trigger, or remotely reachable attack path.

Researcher notes

Key unknowns are reachability, required privileges, affected configurations, and practical impact. The evidence names a potential null pointer dereference in drivers/opp/core.c and references stable fixes, but does not provide CWE, CVSS, proof-of-concept status, or distribution mapping.

Mitigation direction

  • Check Linux vendor or distribution advisories for fixed kernel packages.
  • Prioritize updates on systems running affected Linux kernel versions.
  • Track the referenced stable kernel commits in kernel maintenance workflows.
  • Avoid assuming product-specific fixes beyond vendor guidance.

Validation and detection

  • Inventory deployed Linux kernel versions across servers and appliances.
  • Compare kernel versions against the CVE affected-version data and vendor advisories.
  • Confirm whether vendor kernels include the referenced stable fixes.
  • Record unsupported or custom kernels for separate engineering review.
Prepared
Confidence
medium
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2023-53664 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
3Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux84cb7ff35fcf7c0b552f553a3f2db9c3e92fc707, 84cb7ff35fcf7c0b552f553a3f2db9c3e92fc707unaffected
LinuxLinux6.5, 0, 6.5.3, 6.6affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.