LiveActive security incident?Get immediate response
CVE Record

CVE-2023-54319: pinctrl: at91-pio4: check return value of devm_kasprintf()

In the Linux kernel, the following vulnerability has been resolved: pinctrl: at91-pio4: check return value of devm_kasprintf() devm_kasprintf() returns a pointer to dynamically allocated memory. Pointer could be NULL in case allocation fails. Check pointer validity. Identified with coccinelle (kmerr.cocci script). Depends-on: 1c4e5c470a56 ("pinctrl: at91: use devm_kasprintf() to avoid potential leaks") Depends-on: 5a8f9cf269e8 ("pinctrl: at91-pio4: use proper format specifier for unsigned int")

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

This is a Linux kernel reliability flaw in the at91-pio4 pin control driver. If a small memory allocation fails, the driver may use a NULL pointer instead of handling the failure. The sources do not show active exploitation, business impact, CVSS, or a broad remote attack path.

Executive priority

Monitor and remediate through standard Linux kernel patch cycles. Escalate priority only for environments confirmed to use the affected driver or where kernel stability on those devices is business-critical.

Technical view

The fix adds validation for devm_kasprintf() in the Linux pinctrl at91-pio4 driver. The CVE record states devm_kasprintf() can return NULL on allocation failure and the pointer validity was not checked. Multiple stable kernel commits are listed as references for the resolved issue.

Likely exposure

Exposure appears limited to Linux kernels in the listed affected versions or branches that include and use the at91-pio4 pinctrl driver. The source bundle does not identify affected distributions, hardware platforms, packages, or default configurations.

Exploitation context

The source bundle does not cite exploitation in the wild, public exploit code, KEV listing, privilege requirements, or network reachability. Treat this as a kernel defect requiring normal patch management, with urgency driven by whether affected systems actually use this driver.

Researcher notes

Evidence supports a NULL-check omission in a specific Linux kernel driver, found by Coccinelle. The bundle lacks CVSS, CWE, crash details, exploitability analysis, affected distribution mapping, and precise fixed-version ranges beyond stable commit references.

Mitigation direction

  • Check Linux vendor or distribution advisories for a kernel containing the referenced fix.
  • Update affected kernels through the normal vendor-supported kernel update channel.
  • Prioritize systems that build, load, or depend on the at91-pio4 pinctrl driver.
  • If patch timing is constrained, follow vendor guidance for interim risk reduction.

Validation and detection

  • Inventory kernel versions against the affected versions listed in the CVE source bundle.
  • Determine whether the at91-pio4 pinctrl driver is present, built in, or loadable.
  • Confirm the deployed kernel includes the relevant stable fix commit or vendor backport.
  • After updating, verify the system boots and hardware pin control functions normally.
Prepared
Confidence
medium
Sources
11

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2023-54319 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
10Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux776180848b574c9c01217fa958f10843ffce584f, 776180848b574c9c01217fa958f10843ffce584f, 776180848b574c9c01217fa958f10843ffce584f, 776180848b574c9c01217fa958f10843ffce584f, 776180848b574c9c01217fa958f10843ffce584f, 776180848b574c9c01217fa958f10843ffce584f, 776180848b574c9c01217fa958f10843ffce584f, 776180848b574c9c01217fa958f10843ffce584f, 776180848b574c9c01217fa958f10843ffce584funaffected
LinuxLinux4.4, 0, 4.14.322, 4.19.291, 5.4.251, 5.10.188, 5.15.121, 6.1.39, 6.3.13, 6.4.4, 6.5affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.