LiveActive security incident?Get immediate response
CVE Record

CVE-2023-54315: powerpc/powernv/sriov: perform null check on iov before dereferencing iov

In the Linux kernel, the following vulnerability has been resolved: powerpc/powernv/sriov: perform null check on iov before dereferencing iov Currently pointer iov is being dereferenced before the null check of iov which can lead to null pointer dereference errors. Fix this by moving the iov null check before the dereferencing. Detected using cppcheck static analysis: linux/arch/powerpc/platforms/powernv/pci-sriov.c:597:12: warning: Either the condition '!iov' is redundant or there is possible null pointer dereference: iov. [nullPointerRedundantCheck] num_vfs = iov->num_vfs; ^

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

This is a Linux kernel bug in PowerPC PowerNV SR-IOV handling. A missing null check can cause the kernel to dereference a null pointer. The source does not provide CVSS, severity, or evidence of active exploitation.

Executive priority

Handle through normal kernel patch management unless PowerPC PowerNV SR-IOV systems are business-critical. There is no supplied evidence of active exploitation, but kernel crashes can still affect availability.

Technical view

In arch/powerpc/platforms/powernv/pci-sriov.c, pointer iov was dereferenced to read num_vfs before checking whether iov was null. The Linux fix moves the null check before dereference, preventing a potential null pointer dereference in that SR-IOV path.

Likely exposure

Exposure appears limited to affected Linux kernels on PowerPC PowerNV systems using the relevant PCI SR-IOV code path. The bundle does not identify non-Linux products, userland components, or broad cross-architecture exposure.

Exploitation context

The source describes a static-analysis-detected kernel null pointer dereference. It does not provide exploit details, proof of exploitation, or KEV listing. Treat active exploitation as unsupported by the supplied evidence.

Researcher notes

The affected area is narrow: PowerPC PowerNV PCI SR-IOV handling. The available evidence supports a null pointer dereference fix, not privilege escalation or remote exploitation. Version impact should be validated against downstream kernel backports.

Mitigation direction

  • Update affected Linux kernels to versions containing the referenced stable fixes.
  • Prioritize PowerPC PowerNV hosts where PCI SR-IOV is enabled or operationally important.
  • Use distribution or vendor kernel advisories to confirm the exact fixed package version.
  • If patching is delayed, follow vendor guidance for risk reduction and monitoring.

Validation and detection

  • Inventory Linux kernel versions on PowerPC PowerNV systems.
  • Check whether PCI SR-IOV is enabled on those hosts.
  • Confirm the installed kernel includes one of the referenced stable commits or downstream backport.
  • Review kernel logs for null pointer dereference events in PowerNV PCI SR-IOV paths.
Prepared
Confidence
medium
Sources
8

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2023-54315 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
7Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux052da31d45fc71238ea8bed7e9a84648a1ee0bf3, 052da31d45fc71238ea8bed7e9a84648a1ee0bf3, 052da31d45fc71238ea8bed7e9a84648a1ee0bf3, 052da31d45fc71238ea8bed7e9a84648a1ee0bf3, 052da31d45fc71238ea8bed7e9a84648a1ee0bf3, 052da31d45fc71238ea8bed7e9a84648a1ee0bf3unaffected
LinuxLinux5.9, 0, 5.10.188, 5.15.121, 6.1.39, 6.3.13, 6.4.4, 6.5affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.