LiveActive security incident?Get immediate response
CVE Record

CVE-2023-54118: serial: sc16is7xx: setup GPIO controller later in probe

In the Linux kernel, the following vulnerability has been resolved: serial: sc16is7xx: setup GPIO controller later in probe The GPIO controller component of the sc16is7xx driver is setup too early, which can result in a race condition where another device tries to utilise the GPIO lines before the sc16is7xx device has finished initialising. This issue manifests itself as an Oops when the GPIO lines are configured: Unable to handle kernel read from unreadable memory at virtual address ... pc : sc16is7xx_gpio_direction_output+0x68/0x108 [sc16is7xx] lr : sc16is7xx_gpio_direction_output+0x4c/0x108 [sc16is7xx] ... Call trace: sc16is7xx_gpio_direction_output+0x68/0x108 [sc16is7xx] gpiod_direction_output_raw_commit+0x64/0x318 gpiod_direction_output+0xb0/0x170 create_gpio_led+0xec/0x198 gpio_led_probe+0x16c/0x4f0 platform_drv_probe+0x5c/0xb0 really_probe+0xe8/0x448 driver_probe_device+0xe8/0x138 __device_attach_driver+0x94/0x118 bus_for_each_drv+0x8c/0xe0 __device_attach+0x100/0x1b8 device_initial_probe+0x28/0x38 bus_probe_device+0xa4/0xb0 deferred_probe_work_func+0x90/0xe0 process_one_work+0x1c4/0x480 worker_thread+0x54/0x430 kthread+0x138/0x150 ret_from_fork+0x10/0x1c This patch moves the setup of the GPIO controller functions to later in the probe function, ensuring the sc16is7xx device has already finished initialising by the time other devices try to make use of the GPIO lines. The error handling has also been reordered to reflect the new initialisation order.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2023-54118 is a Linux kernel driver bug that can crash affected systems during device initialization. It concerns the sc16is7xx serial/GPIO driver setting up GPIO support before the device is fully ready. Exposure appears narrow and hardware-dependent, but impacted embedded or appliance systems could see availability failures.

Executive priority

Prioritize where Linux runs on appliances, embedded platforms, or hardware using sc16is7xx GPIO lines. Broad enterprise urgency is lower without evidence of active exploitation, but affected devices may crash during initialization and should be patched through normal kernel maintenance.

Technical view

The sc16is7xx driver registers GPIO controller functions too early in probe, allowing another device to use GPIO lines before initialization completes. The reported result is a kernel Oops in sc16is7xx_gpio_direction_output when GPIO lines are configured. The fix moves GPIO controller setup later and reorders error handling.

Likely exposure

Systems running affected Linux kernels with the sc16is7xx driver and GPIO consumers using those lines are most relevant. Generic Linux servers are less likely exposed unless this driver and hardware path are present. The source lists affected Linux versions including 3.16, 5.10.173, 5.15.100, 6.1.18, 6.2.5, and 6.3.

Exploitation context

The source bundle does not show KEV listing, active exploitation, CVSS, or a remote attack path. The described impact is a race condition causing a kernel Oops during GPIO configuration. Treat this as reliability and availability risk unless vendor guidance identifies broader impact.

Researcher notes

Evidence is limited to the CVE record and Linux stable commit references. No CWE, CVSS, exploit status, or vendor-specific distro fix matrix is provided. The bug is tied to probe ordering and GPIO consumer timing, so validation should focus on driver presence and affected hardware configuration.

Mitigation direction

  • Apply a supported kernel update containing the referenced stable fixes.
  • Check Linux distribution or device vendor advisories for backported patches.
  • Prioritize embedded systems using sc16is7xx serial or GPIO functionality.
  • Track custom kernel trees for the GPIO setup ordering change.

Validation and detection

  • Inventory systems for affected kernel versions and sc16is7xx driver use.
  • Confirm vendor kernel packages include one of the referenced stable fixes.
  • Review boot and kernel logs for sc16is7xx GPIO Oops traces.
  • Test affected hardware paths after patching to confirm GPIO initialization succeeds.
Prepared
Confidence
medium
Sources
7

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2023-54118 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
6Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxdfeae619d781dee61666d5551b93ba3be755a86b, dfeae619d781dee61666d5551b93ba3be755a86b, dfeae619d781dee61666d5551b93ba3be755a86b, dfeae619d781dee61666d5551b93ba3be755a86b, dfeae619d781dee61666d5551b93ba3be755a86bunaffected
LinuxLinux3.16, 0, 5.10.173, 5.15.100, 6.1.18, 6.2.5, 6.3affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.