CVE-2023-54178: Linux vulnerability

CVE-2023-54178: of: unittest: fix null pointer dereferencing in of_unittest_find_node_by_name()

In the Linux kernel, the following vulnerability has been resolved: of: unittest: fix null pointer dereferencing in of_unittest_find_node_by_name() when kmalloc() fail to allocate memory in kasprintf(), name or full_name will be NULL, strcmp() will cause null pointer dereference.

UnknownCVSS not scoredNot KEV-listedUpdatedMay 11, 2026, 19:56 UTC (UTC+00:00)

Security readout for executives and security teams

Plain-English summary

This Linux kernel issue can crash code in an Open Firmware unittest path when memory allocation fails and the code compares a NULL string. The bundle does not show remote exploitation, privilege escalation, or active abuse.

Executive priority

Treat as routine kernel maintenance unless your environment depends on affected builds. There is no source-backed evidence of active exploitation or broad remote attackability.

Technical view

The resolved flaw is a NULL pointer dereference in of_unittest_find_node_by_name(). If kasprintf() fails, name or full_name may be NULL, and strcmp() can dereference it. The source bundle lists Linux kernel stable fixes across multiple branches.

Likely exposure

Exposure appears limited to Linux kernels in the listed affected stable version ranges or downstream builds that include the vulnerable code before the referenced fixes.

Exploitation context

No KEV listing is present, and the provided sources do not claim active exploitation. The trigger described is an allocation failure before strcmp() in unittest-related kernel code.

Researcher notes

The record lacks CVSS, CWE, and detailed exploitability context. Analysis should stay anchored to the stated NULL dereference in unittest code and the linked stable kernel commits.

Mitigation direction

Update affected Linux kernels to vendor packages containing the referenced stable fixes.
Check your Linux distribution advisory for the exact fixed package version.
Prioritize systems running listed affected kernel branches before the fixed releases.
If immediate upgrade is blocked, monitor vendor guidance for supported mitigations.

Validation and detection

Inventory running Linux kernel versions across managed systems.
Compare versions against the affected and fixed branch data in the CVE bundle.
Verify the relevant stable fix commit or downstream backport is present.
Review kernel logs for NULL dereference crashes involving of_unittest_find_node_by_name().

Prepared: Jul 11, 2026, 07:26 UTC (UTC+00:00)
Confidence: medium
Sources: 11

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2023-54178 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup

Vulnerability profileCVE Program record

Severity: Unknown
CVSS: Not scored
Known Exploited: No
Published: Dec 30, 2025, 12:08 UTC (UTC+00:00)

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors

3Timeline events

0ADP providers

10Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
Dec 30, 2025, 12:06 UTC (UTC+00:00)
CVE publishedCVE Program
The CVE record was published.
Dec 30, 2025, 12:08 UTC (UTC+00:00)
CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
May 11, 2026, 19:56 UTC (UTC+00:00)

Source materials

CVE List V5 sourceCVE List V5
https://git.kernel.org/stable/c/c364fa869b33ca42a263bf91c22fce7e6c61d479CVE reference, Linux
https://git.kernel.org/stable/c/0b7d715511915a1b39f5fdcbe57a7922dfd66513CVE reference, Linux
https://git.kernel.org/stable/c/dadf0d0dfcc81cdcb27ba5426676d13a9e4fb925CVE reference, Linux
https://git.kernel.org/stable/c/f41c65f8d05be734898cbe72af59a401b97d298aCVE reference, Linux
https://git.kernel.org/stable/c/ea5bc6f5aa099e3e84d037282836234ad77cba88CVE reference, Linux
https://git.kernel.org/stable/c/43cc228099c514467b8074d7ede6673cef9f33b9CVE reference, Linux
https://git.kernel.org/stable/c/c74ae8124f9687062dd99858f34c9d027ddd73daCVE reference, Linux
https://git.kernel.org/stable/c/2dd8ee9de71ad8447f8459fb01dade7f6c7132daCVE reference, Linux
https://git.kernel.org/stable/c/d6ce4f0ea19c32f10867ed93d8386924326ab474CVE reference, Linux

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus

LinuxLinux0d638a07d3a1e98a7598eb2812a6236324e4c55f, 0d638a07d3a1e98a7598eb2812a6236324e4c55f, 0d638a07d3a1e98a7598eb2812a6236324e4c55f, 0d638a07d3a1e98a7598eb2812a6236324e4c55f, 0d638a07d3a1e98a7598eb2812a6236324e4c55f, 0d638a07d3a1e98a7598eb2812a6236324e4c55f, 0d638a07d3a1e98a7598eb2812a6236324e4c55f, 0d638a07d3a1e98a7598eb2812a6236324e4c55f, 0d638a07d3a1e98a7598eb2812a6236324e4c55funaffected

LinuxLinux4.14, 0, 4.14.326, 4.19.295, 5.4.257, 5.10.195, 5.15.132, 6.1.53, 6.4.16, 6.5.3, 6.6affected

Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.