LiveActive security incident?Get immediate response
CVE Record

CVE-2023-54027: iio: core: Prevent invalid memory access when there is no parent

In the Linux kernel, the following vulnerability has been resolved: iio: core: Prevent invalid memory access when there is no parent Commit 813665564b3d ("iio: core: Convert to use firmware node handle instead of OF node") switched the kind of nodes to use for label retrieval in device registration. Probably an unwanted change in that commit was that if the device has no parent then NULL pointer is accessed. This is what happens in the stock IIO dummy driver when a new entry is created in configfs: # mkdir /sys/kernel/config/iio/devices/dummy/foo BUG: kernel NULL pointer dereference, address: ... ... Call Trace: __iio_device_register iio_dummy_probe Since there seems to be no reason to make a parent device of an IIO dummy device mandatory, let’s prevent the invalid memory access in __iio_device_register when the parent device is NULL. With this change, the IIO dummy driver works fine with configfs.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

This Linux kernel issue can crash the kernel when an Industrial I/O dummy device is created without a parent device. The public record describes a NULL pointer dereference, not data theft or remote compromise. Business urgency depends on whether affected kernels and the IIO dummy/configfs path are present.

Executive priority

Treat this as a targeted kernel stability issue unless vendor scoring says otherwise. It warrants normal patch management priority, with faster action for systems where untrusted users can influence configfs or IIO dummy device creation.

Technical view

A change in Linux IIO core label retrieval used firmware node handles and allowed __iio_device_register to dereference NULL when dev->parent is absent. The stock IIO dummy driver could trigger this through configfs device creation. Stable kernel commits add handling for a NULL parent.

Likely exposure

Exposure is most likely on Linux systems running affected kernel builds with IIO core, the dummy IIO driver, and relevant configfs access. The bundle lists Linux versions including 5.19, 6.1.46, 6.4.11, and 6.5, but version metadata is incomplete.

Exploitation context

No CISA KEV listing or active exploitation evidence is provided. The public description shows a local configfs-triggered kernel BUG scenario in the stock IIO dummy driver. Remote exploitability is not supported by the supplied sources.

Researcher notes

The evidence supports NULL pointer dereference and kernel crash conditions, but not privilege escalation, information disclosure, or remote attack. Affected-version semantics in the bundle are weak, so use vendor kernel package data and stable commit ancestry for confirmation.

Mitigation direction

  • Check vendor kernel advisories for patched packages matching the stable commits.
  • Prioritize kernel updates on systems exposing IIO dummy devices or configfs workflows.
  • Disable or avoid the IIO dummy driver where it is unnecessary.
  • Limit configfs access to trusted administrators according to existing system policy.

Validation and detection

  • Inventory Linux kernel versions and map them to vendor-fixed builds.
  • Check whether IIO dummy driver and configfs are enabled on relevant hosts.
  • Review kernel logs for NULL pointer dereference traces in __iio_device_register.
  • Confirm installed kernels include one of the referenced stable fixes or vendor backports.
Prepared
Confidence
medium
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2023-54027 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
4Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux813665564b3d7c74412fe2877520f1d254ce948a, 813665564b3d7c74412fe2877520f1d254ce948a, 813665564b3d7c74412fe2877520f1d254ce948aunaffected
LinuxLinux5.19, 0, 6.1.46, 6.4.11, 6.5affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.